Authentication

The public API is stateless. Every authenticated request must send a personal access token in the Authorization header as a bearer token.

Token format

  • Prefix: rkpat_
  • Structure: rkpat_<public_id>.<secret>
  • Token secrets are shown only once when the token is created in the cabinet.

How to create a token

  1. Open the API access section in the Reportkey web app.
  2. Create a personal access token with the scopes your integration needs and choose either a fixed expiration or no expiration.
  3. Save the token secret immediately. Reportkey stores only the hashed secret.

Available read scopes today

  • account:read for GET /api/v1/me
  • projects:read for project list and project detail
  • reports:read for report and job read surfaces

Example request

curl -sS https://api.reportkey.net/api/v1/projects \
  -H 'Authorization: Bearer rkpat_yourpublicid.yoursecret'

Common authentication errors

  • authentication_required: the request did not include a bearer token.
  • invalid_token: the token format is wrong or the secret does not match.
  • token_expired: the token has reached its expiry date. Non-expiring tokens do not return this error.
  • token_revoked: the token has been revoked in the API access section.
  • insufficient_scope: the token does not include the scope required by the route.
  • api_access_required: the current tariff or add-on no longer grants Public API access.

Plan and entitlement behavior

  • Public API access is tied to the current billing plan and, where applicable, a dedicated API add-on.
  • A token that was valid before can start returning api_access_required if the account loses API entitlement.
  • The error payload includes upgrade metadata so the client can guide the operator to the right cabinet screen.

Try-it guidance

  • The reference page uses the public API host and the same bearer token flow as production integrations.
  • Use a dedicated token with the minimum scopes required for interactive checks.