Skip to Content
Authentication

Authentication

API keys

Public API calls authenticate with a rz_live_ key, minted in the dashboard. Send it either way:

# Preferred
curl "$BASE/ping" -H "x-access-key: $REZMATCH_API_KEY"
 
# Also accepted
curl "$BASE/ping" -H "Authorization: Bearer $REZMATCH_API_KEY"

How keys are stored

The raw key is shown exactly once at mint time. Rezmatch.ai stores only its SHA-256 hash — nobody, including Rezmatch.ai, can recover a lost key. Lose one? Revoke it and mint another; keys are free and you can hold several (one per environment is a good pattern).

Revocation

Revoking a key flips its status — it is never hard-deleted, so your usage history stays intact. Revocation takes effect within about 60 seconds (the authorizer cache TTL).

Key hygiene

  • Keep keys server-side. Never ship a key in client-side JavaScript or a mobile app.
  • Use environment variables or a secret manager; never commit keys to git.
  • Mint separate keys per environment/integration so you can revoke narrowly.

OAuth (MCP connectors)

When you add Rezmatch.ai to Claude as a connector using just the base URL, authentication happens via OAuth: you sign in with your dashboard account and Claude receives a scoped token. Same account, same credit balance, no key to paste.

Management API

Dashboard operations (minting keys, listing usage) live on a separate API authenticated by your dashboard session JWT — it never accepts API keys, and the public API never accepts session JWTs. The two credential worlds don’t cross.

Last updated on
QuickstartCredits & Pricing