API Keys

API keys authenticate your application with Risicare. Each key is scoped to exactly one project — this is how the gateway knows which project your traces belong to.

Key Format

rsk-a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
│   └── 32 hex characters (generated via secrets.token_hex(16))
└── Prefix (always "rsk-")

Keys are validated by SHA256 hash -- the plaintext key is never stored. On each request the hash is checked against a Redis cache (60s TTL, configurable) first, with a PostgreSQL fallback if the cache misses.

Creating Keys

Via Dashboard

1. Navigate to Settings → API Keys
2. Click "Create API Key"
3. Select the target project (if you have multiple projects)
4. Enter a name (e.g., "production-sdk")
5. Click "Create Key"
6. Copy the key and quickstart snippet (shown only once!)

Via API

curl -X POST "https://app.risicare.ai/v1/api-keys" \
  -H "Authorization: Bearer rsk-..." \
  -d '{
    "name": "production-sdk",
    "project_id": "proj-abc123"
  }'

Response:

{
  "id": "key-xyz789",
  "name": "production-sdk",
  "key": "rsk-a1b2c3d4e5f6a1b2...",
  "prefix": "rsk-a1b2c3d4",
  "project_id": "proj-abc123",
  "created_at": "2024-01-15T10:00:00Z"
}

Using Keys

In SDK

import risicare
 
risicare.init(api_key="rsk-...")

Environment Variable

export RISICARE_API_KEY="rsk-..."

In API Requests

curl -X GET "https://app.risicare.ai/v1/traces" \
  -H "Authorization: Bearer rsk-..."

Key Security

Best Practices

• Never commit keys to version control
• Use environment variables or secrets managers
• Create separate keys for each environment
• Rotate keys periodically
• Revoke unused keys

Key Rotation

1. Create a new key
2. Update your application
3. Verify new key works
4. Revoke old key

Viewing Keys

List all keys (prefix only shown):

curl -X GET "https://app.risicare.ai/v1/api-keys" \
  -H "Authorization: Bearer rsk-..."

{
  "keys": [
    {
      "id": "key-xyz789",
      "name": "production-sdk",
      "prefix": "rsk-a1b2c3d4",
      "project_id": "proj-abc123",
      "created_at": "2024-01-15T10:00:00Z",
      "last_used_at": "2024-01-15T11:30:00Z"
    }
  ]
}

Revoking Keys

Via Dashboard

1. Navigate to Settings → API Keys
2. Find the key
3. Click "Revoke"
4. Confirm

Via API

curl -X DELETE "https://app.risicare.ai/v1/api-keys/{key_id}" \
  -H "Authorization: Bearer rsk-..."

Revoked keys immediately stop working.

Rate Limits

API keys have rate limits:

Rate limit headers:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 950
X-RateLimit-Reset: 1705312800

Next Steps