Getting started
Authentication
Send your key in the Authorization header of every data request. A key in the query string is ignored, so the request answers 401. Only the contract, /api/v1/openapi.json, needs no key.
Key format
Keys start with rp_live_. A key only reads the agency that created it, and only what its permissions allow (see Permissions).
Keep keys on a server
Anyone who has the key reads everything it can see. Never put it in a website or in an app your clients download: that app calls your own server, and your server calls RoundPlan.
Lost or leaked keys
An owner revokes a key in Settings → API. It stops working on the next request. The key is shown only once, when it is created, so a lost key is revoked and replaced.