Docs / Authentication

Authentication

Last updated 2026-11-13

API keys, sent in a header.

Sign up with your email, tell us how you will use the API, and open the link we send. The key (rdb_<id>_<secret>) is shown once, and we keep only a hash of it. There is one free key per verified email.

Authorization header

Authorization: Bearer rdb_YOUR_KEY

X-API-Key: rdb_YOUR_KEY also works. Keys in the URL (a query string) are ignored, because URLs end up in logs.

Never put a key in client-side code or a public repository. Call the API from your server.
If a key leaks, write to support@recalldb.app and it will be replaced.
Missing, wrong and revoked keys answer 401; a suspended key answers 403 (errors).