Skip to main content

Authentication

The Rewind Public API uses API key authentication with the X-API-Key header. This approach ensures secure access to your organization's data while maintaining simplicity and reliability.

API Key Authentication​

All requests must include a valid API key in the X-API-Key header:

curl "https://developer.rewind.com/api/v1/accounts" \
  -H "X-API-Key: YOUR_API_KEY"

API Key Requirements​

  • Must be generated by an organization owner or admin
  • Keys are scoped to a specific organization
  • Keys can be created, viewed, and revoked through the Rewind app
  • Each key requires a name and an expiration date.
  • An organization can have up to 10 active keys at a time.

Security Considerations​

Key Storage​

  • Never store API keys in client-side code or version control
  • Use environment variables or secure secret management
  • Rotate keys periodically for enhanced security
  • Use different keys for different environments (development, staging, production)

Key Scope​

API keys inherit the permissions of the user who created them and provide access to:

  • All accounts within the associated organization
  • Organization-level settings and metadata
  • Audit logs and usage information

Testing Your API Key​

Use the token validation endpoint to verify your API key:

curl "https://developer.rewind.com/api/v1/token" \
  -H "X-API-Key: YOUR_API_KEY"

This returns information about the key name, expiration date, and associated organization.

Common Authentication Errors​

401 Unauthorized​

Missing, invalid, or expired API key:

HTTP/1.1 401 Unauthorized
{
  "title": "Unauthenticated",
  "status": 401,
  "instance": "/api/v1/accounts",
  "request_id": "abc123"
}

Common causes:

  • Missing X-API-Key header
  • Invalid or expired API key
  • API key for a different organization
  • User who created the key no longer has access

403 Forbidden​

Valid API key but insufficient permissions:

HTTP/1.1 403 Forbidden
{
  "title": "You are not authorized to perform this action.",
  "status": 403,
  "instance": "/api/v1/accounts/acc_123",
  "request_id": "def456"
}

Common causes:

  • Attempting to access resources outside your organization
  • User permissions changed after key creation
  • Account-specific access restrictions

Troubleshooting​

Testing Connectivity​

Always test your API key with a simple request:

curl -I "https://developer.rewind.com/api/v1/token" \
  -H "X-API-Key: YOUR_API_KEY"

Debugging Authentication Issues​

  1. Verify the API key format and completeness
  2. Check if the key has expired
  3. Confirm the user who created the key still has access
  4. Review audit logs for authentication attempts
  5. Contact support with the X-Request-ID or request_id from error responses