Authentication

Learn about API keys, scopes, and secure authentication methods for the Revuloop API.

API Key Authentication

All API requests must include a valid API key in the Authorization header using the Bearer token scheme. API access requires a PRO or BUSINESS subscription.

Authorization: Bearer YOUR_API_KEY

Key Formats

rlk_live_*Organization API key (production)
rlk_test_*Organization API key (testing)
rlpk_live_*Partner API key (production)
rlpk_test_*Partner API key (testing)
rlet_*Embed token (short-lived)

Best Practices

Never expose API keys in client-side code or public repositories
Use environment variables to store keys securely
Rotate keys periodically and revoke unused keys
Use the minimum required scopes for each key
Use TEST environment keys during development

API Scopes

Scopes control what resources an API key can access. Follow the principle of least privilege by only granting the scopes your application needs. Scopes are organized by resource (e.g., surveys, responses, analytics) with read, write, and wildcard (*) permissions.

View all scopes in the API Reference

Wildcard Scopes

Scopes ending with :* are wildcard scopes that grant all permissions for that resource. For example:

surveys:* includes surveys:read, surveys:write, and surveys:launch
* grants full access to all API resources

Warning: Avoid using wildcard scopes in production unless absolutely necessary. They grant broad access that may exceed your application's actual needs.

OAuth 2.0 (Partner Integration)

For partner integrations that require user authorization, we support OAuth 2.0 with PKCE. This allows your application to access Revuloop on behalf of users.

OAuth Flow

Redirect user to the authorization endpoint
User grants permission to your application
Receive authorization code via callback
Exchange code for access token
Use access token for API requests

Getting Started Webhooks