API keys - R3AL.AI

Standalone API keys are independent of platform accounts — meant for CI, scripts, or third-party integrations that shouldn’t need a login. Minting one (or setting R3AL_API_KEY) is also what switches the whole API from open to auth-required; see Authentication. Requires the Admin or Developer role when called with a session token.

Create a key

curl -X POST https://platform.r3al.ai/v1/keys \
  -H "Authorization: Bearer <admin or developer credential>" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-pipeline", "env": "prod"}'

{
  "id": "k_a1b2c3d4e5f6",
  "name": "ci-pipeline",
  "env": "prod",
  "scope": "all",
  "key": "r3l_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "masked": "r3l_live_•••••••e5f6"
}

key is the real secret and is only ever returned once, in this response. It’s stored server-side only as a SHA-256 hash — there’s no way to retrieve it again later, only revoke and mint a new one.

Field	Default	Notes
`name`	—	Required
`env`	`"dev"`	Free-form label; `"prod"` gets an `r3l_live_` prefix, anything else `r3l_test_`
`scope`	`"all"`	Free-form label, not currently enforced

List keys

curl https://platform.r3al.ai/v1/keys -H "Authorization: Bearer <credential>"

{
  "keys": [
    {
      "id": "k_a1b2c3d4e5f6",
      "name": "ci-pipeline",
      "env": "prod",
      "scope": "all",
      "masked": "r3l_live_•••••••e5f6",
      "created_at": 1752600000.0,
      "last_used_at": 1752690000.0,
      "call_count": 214
    }
  ],
  "count": 1
}

Real, live usage — call_count and last_used_at update on every authenticated request that key makes.

Revoke a key

curl -X DELETE https://platform.r3al.ai/v1/keys/k_a1b2c3d4e5f6 \
  -H "Authorization: Bearer <credential>"

Permanently deletes the key (and its usage history). 404 if the id doesn’t exist.