Authentication & scopes

How each request is authenticated and what each permission the business owner grants you means.

How to send the key#

Every request carries the access key. Two equivalent forms are accepted; use whichever suits your HTTP client:

# Option 1 — Authorization header (recommended)
curl -H "Authorization: Bearer r2k_a1b2c3d4..." "https://api.r2-os.com/api/connect/v1/account"

# Option 2 — x-api-key header
curl -H "x-api-key: r2k_a1b2c3d4..." "https://api.r2-os.com/api/connect/v1/account"

All keys start with r2k_. Each key belongs to a single business: you do not need — and cannot — specify which business you are requesting data for. R2 determines it from the key.

Available scopes#

The owner picks the scopes when creating the key. If you try to read a resource without its scope, the response is 403 and nothing else. Always ask for the minimum your integration needs: that is what earns trust at authorization time.

The /account resource requires no scope: any valid key can query it, and its response includes a scopes list with what that key may actually read. Use it when your integration starts, to adjust what you will request.

Lifetime and revocation#

• Keys do not expire over time.
• The owner can revoke them at any moment from their dashboard; the effect is immediate and the next request receives 401.
• Revoking is final: a revoked key is not reactivated, a new one is created.
• Every request is recorded in the owner’s dashboard, with the date, the resource queried and the result.