API Keys
Every API request must carry the Authorization Header value of one of your API keys, which you copy from the API Keys table in the RPI Print API Dashboard. The header uses HTTP Basic authentication. The API key identifies and authenticates the customer making the request, and it decides whether the request works in sandbox or production mode. API keys are authentication secrets. Store them securely and provide them to your application securely. If a key is exposed for any reason, rotate it: create a new key, and then disable the old one.
Enabled and disabled keys
Every API key is either enabled or disabled. A request you authenticate with an enabled key succeeds; a request you authenticate with a disabled key is rejected with HTTP 403.
Disabling a key neither deletes it nor changes its Authorization Header value, so you can enable the same key later and your existing header keeps working.
Your keys are listed under Developer Tools in the RPI Print API Dashboard, where you can read each key's current state and change it.
Allow up to 5 minutes for a change to take effect
The API keeps the result of each authentication check for 5 minutes, so for that long it can still answer with a decision it reached before you changed the key:
- A key you disabled can keep working for up to 5 minutes.
- A key you enabled can keep being rejected for up to 5 minutes.
Five minutes is the longest either delay lasts. The API may apply your change sooner, and it applies the change within 5 minutes.
Disabling a key does not revoke it on the spot. If someone outside your organization has obtained a key, disable it and then treat the following 5 minutes as time in which that person can still call the API with it.