API keys
Data endpoints require a Bearer token./v1/health, /v1/health/sync, and /v1/openapi.json are public. Webhooks use their provider-specific verification.
Key types
New keys use
rw_ followed by a random token. The key record stores its scope; the token prefix does not distinguish read access from admin access.
A read key grants access to the archive associated with that key. Keep it server-side unless you intend to expose that data to everyone who can inspect the client. Keep admin keys server-side.
Request a key from the Rewind administrator. Key creation and revocation require an existing admin key; there is no public self-service signup.
Rate limiting
Each API key has a configurable request limit per 60-second sliding window. Authenticated responses that reach the rate limiter carry the current state in headers; exceeding the limit returns429 Too Many Requests. Use X-RateLimit-Limit to read your key’s limit.