Authentication
Every request is authenticated with a single header. There are two kinds of key, used for different purposes — do not mix them up.
The header
X-API-KEY: YOUR_KEY
Always send it as a header, never as a query parameter or in the request body — query strings get logged by proxies and browsers history.
Server API Key
| Used for | /api/v1/score, /api/v1/risk_assessments/:id, /api/v1/outcomes |
|---|---|
| Where it lives | Your backend only. Never ship it in browser/mobile-app code. |
| Secrecy | Secret — treat like a password. |
Browser Key
| Used for | /api/v1/browser_telemetry, /api/v1/telemetry_sessions, and the signup page script |
|---|---|
| Where it lives | Front-end code — it's designed to be public. |
| Secrecy | Not secret, but restricted to an allow-list of domains you configure. Requests from any other origin are rejected. |
Getting your keys
Keys are issued from your Revylta account (Account → API Keys / Browser Keys). If you don't have account access yet, ask your Revylta contact to create one for you or invite you.
Unauthorized responses
HTTP/1.1 401 Unauthorized
{
"error": "Unauthorized"
}HTTP/1.1 403 Forbidden
{
"error": "Origin not allowed"
}