> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rigaly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, security, and key lifecycle

Every request to the Rigaly API is authenticated with an API key in the `Authorization` header:

```
Authorization: Bearer rgly_sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

## Keys

* Keys are created in the business dashboard under **Tools → API Management** (up to 10 active keys per business).
* The full key is shown **once** at creation. Rigaly stores only a hash — if you lose a key, roll it or create a new one.
* Every key has full access to your business's data and nothing else — keys never see other businesses.
* `last_used_at` is tracked per key so you can spot unused keys.

## Key lifecycle

| Action     | Effect                                                                                                          |
| ---------- | --------------------------------------------------------------------------------------------------------------- |
| **Create** | New key, shown once. Name it after where it runs ("Production store", "Staging").                               |
| **Roll**   | Revokes the key and issues a replacement with the same name — for scheduled rotation or after a suspected leak. |
| **Revoke** | The key stops working within 60 seconds. Kept in the list (revoked) for audit.                                  |

## Security best practices

<AccordionGroup>
  <Accordion title="Keep keys server-side">
    Never embed keys in mobile apps, browser JavaScript, or public repositories. All calls should come from your backend.
  </Accordion>

  <Accordion title="Use environment variables">
    Store keys in environment variables or a secret manager, not in code. The `rgly_sk_` prefix makes accidental commits detectable by secret scanners.
  </Accordion>

  <Accordion title="One key per environment">
    Use separate keys for production and staging so you can revoke one without affecting the other.
  </Accordion>

  <Accordion title="Rotate periodically">
    Roll keys on a schedule (e.g. quarterly). Rolling is atomic — the new key works immediately.
  </Accordion>
</AccordionGroup>

## Account requirements

API access is included for all **approved** businesses at no extra platform cost — pricing stays the same: your monthly subscription plus the per-transaction fee. Requests are rejected with `403` while an account is pending, blocked (payment issue), or suspended.