Skip to main content
Endpoints that read public data need only an App Key. Send the X-RP-API-Key header on every request.

​
Two keys are issued

Registering an app gives you two keys with different purposes.
The secret key is stored only as a hash, so not even Rocketpunch can show it to you again. If you lose it, you have to rotate.

​
Handling keys safely

An App Key identifies your app. If it leaks, someone else can burn through your quota or make calls in your name.
  • Call from your server only. A key in browser JavaScript or a mobile app bundle is readable by anyone.
  • Keep it in environment variables or a secret store. Do not write it into source and commit it.
  • Never push it to a public repository. Reverting is not enough — it stays in history, so rotate immediately.

​
If a key leaks

Rotate it from the app detail screen in the developer console.
1

Rotate

Trigger key rotation on the app detail screen. A new key is issued immediately and the previous one stops working.
2

Replace

Copy the newly displayed secret key right there and move it somewhere safe. You cannot see it again.
3

Deploy

Update the environment variables in your running service and deploy. Calls still using the old key fail with 401 (C0001).
Rotation invalidates the previous key immediately. If you need a zero-downtime swap, plan a deploy window ahead of time.

​
Checking usage

The usage page on the app detail screen shows your per-minute and daily call volume. Successful responses include an X-RP-RateLimit-Remaining header with the calls left in the current minute. Exceeding a limit returns 429 (C0010) with a Retry-After header. Wait that many seconds, then retry.
The limits in effect and the per-operation sub-limits are in the rate limit section of the API reference.

​
Next steps

OAuth 2.0 integration

APIs that need user permission require OAuth 2.0 consent.