Authentication

Use an organization API key for server-to-server integrations. Bearer authentication is available only for clients using an approved sign-in or token flow; do not copy a browser session cookie into an integration.

API Keys

Create keys under Admin > System Settings > Security > Credentials. The full secret is shown once. Store it in a secret manager and send it in the x-api-key header:

curl 'https://api.re-base.io/api/properties?limit=20' \
  --header 'x-api-key: ap_live_REPLACE_ME'

Do not place keys in a URL, browser bundle, source control, ticket, or chat.

Scopes

Scope	Effective action ceiling
api:read	Read operations.
api:write	Read, create, and update; delete is intentionally excluded.
api:delete	Read, create, update, and delete.
api:admin	The key holder’s full allowed permission set.

Resource-specific scopes such as properties:read can narrow a key further. A scope filters the permissions available to the key; it does not grant access the creating user or organization did not already have. Record restrictions and row security still apply.

Bearer Authentication

Where an operation supports an approved bearer token, send:

Authorization: Bearer TOKEN

The public developer documentation does not define a general OAuth client registration flow. Contact re-base.io before designing a third-party delegated authorization integration.

Rotation And Revocation

Create and test a replacement before revoking a production key. Revoke a key immediately if it is exposed, its owner leaves, or the integration is retired. Use expiration for temporary vendors and record the key prefix—not the secret—in operational documentation.

401 Unauthorized means the credential is missing, invalid, expired, or revoked. 403 Forbidden means authentication succeeded but the caller lacks a required permission, scope, organization context, or record access.