Authentication & API keys

The AnswerRidge REST API authenticates with an API key sent in the x-api-key header. Keys are created and managed in the Developer Portal.

Create a key

1. Go to Admin → Developer Portal → API Keys.
2. Click Create key, give it a name, choose scopes, and (optionally) set rate limits, allowed origins and allowed IPs.
3. Copy the key immediately — only its prefix is stored; the full secret is shown once.

Authenticate a request

curl "https://fbyeoijchofxayzhozwy.supabase.co/functions/v1/public-api-v1/v1/info" \
  -H "x-api-key: ar_live_xxxxxxxxxxxxxxxxxxxx"

Scopes

Scope keys to least privilege — e.g. a read-only key for analytics, a tickets-write key for your app's "contact us" form. Browser-exposed keys should be restricted by allowed origins.

Security

• Never commit keys to source control or ship secret keys in frontend code.
• Rotate keys periodically; revoke immediately if leaked.
• Set expires_at for temporary integrations.