Authentication

Secure your API requests with Bearer tokens.

Overview

The RouteRadiant API uses API keys to authenticate requests. You can view and manage your API keys in the Settings page.

Your API keys carry many privileges, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth.

Sending the Token

Authentication to the API is performed via HTTP Basic Auth. Provide your API key as the basic auth username value. You do not need to provide a password.

Authorization: Bearer sk_live_...

Creating and Rotating Keys

Generate a new API key from the Settingspage. Keys are shown in full only once at creation, so copy it into your secret store immediately. If a key is ever leaked or you suspect misuse, revoke it from the same screen and issue a replacement — rotating keys regularly is the fastest way to contain a compromised credential. There is no downtime during rotation: create the new key, update your services, then revoke the old one.

Permissions and Scope

Keys inherit the permissions of the account that created them. In practice this means a key created by a learner account can generate roadmaps and courses and read public community content, while server-side administration endpoints require an authorized admin account. Never issue a key from a shared or elevated account for everyday application use.

Errors and Retries

A missing or invalid credential returns 401 Unauthorized. If you receive a403 Forbidden, the key is valid but lacks permission for the requested resource. Handle these distinctly in your client: refresh or rotate on 401, and surface a permissions message on 403. Respect 429 responses by backing off and retrying after the interval in theRetry-After header.

Security Checklist

  • Store keys server-side only — never in client-side code, repositories, or browser storage.
  • Use environment variables or a secret manager rather than hard-coding keys.
  • Rotate keys on a schedule and immediately after any suspected exposure.
  • Keep each integration on its own key so you can revoke access per service.