API Keys

API keys authenticate your application with Risicare. Each key is scoped to exactly one project — this is how the gateway knows which project your traces belong to.

Key Format

rsk-a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
│   └── 32 hex characters (generated via secrets.token_hex(16))
└── Prefix (always "rsk-")

Keys are validated by SHA256 hash -- the plaintext key is never stored. On each request the hash is checked against a Redis cache (60s TTL, configurable) first, with a PostgreSQL fallback if the cache misses.

Creating Keys

Via Dashboard

1. Navigate to Settings → API Keys
2. Click "Create API Key"
3. Select the target project (if you have multiple projects)
4. Enter a name (e.g., "production-sdk")
5. Click "Create Key"
6. Copy the key and quickstart snippet (shown only once!)

Using Keys

In SDK

import risicare
 
risicare.init(api_key="rsk-...")

Environment Variable

export RISICARE_API_KEY="rsk-..."

In API Requests

curl -X GET "https://app.risicare.ai/api/v1/traces" \
  -H "Authorization: Bearer rsk-..."

Key Security

Best Practices

• Never commit keys to version control
• Use environment variables or secrets managers
• Create separate keys for each environment
• Rotate keys periodically
• Revoke unused keys

Key Rotation

1. Create a new key
2. Update your application
3. Verify new key works
4. Revoke old key

Viewing Keys

The list of keys for your project (with prefixes and last-used timestamps) is shown on the dashboard's Settings → API Keys page. The GET /api/v1/api-keys REST route also denies API-key authentication and returns 403 — there is no Bearer-authenticated way to list keys.

Revoking Keys

Via Dashboard

1. Navigate to Settings → API Keys
2. Find the key
3. Click "Revoke"
4. Confirm

Revoked keys immediately stop working.

Rate Limits

API keys have rate limits based on your project configuration:

Rate limit headers:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 950
X-RateLimit-Reset: 1705312800

Next Steps