Skip to main content

​
API keys

All endpoints (except /v1/health and webhooks) require a Bearer token. 
curl -H "Authorization: Bearer rw_live_..." \
  https://api.rewind.rest/v1/listening/recent

​
Key types

Key typePrefixAccess
Readrw_live_...All GET endpoints
Adminrw_admin_...All endpoints including sync triggers, data management, and key management
Read keys are safe to use in client-side applications. Admin keys should only be used server-side.

​
Rate limiting

Each API key gets 100 requests per 60-second sliding window. Every response carries the current state in headers, and exceeding the limit returns 429 Too Many Requests.
HeaderMeaning
X-RateLimit-LimitRequests allowed per window
X-RateLimit-RemainingRequests left in the current window
X-RateLimit-ResetUnix timestamp (seconds) when the window resets
Retry-AfterSeconds to wait before retrying, sent only on 429

​
Unauthorized responses

If your key is missing or invalid: 
{
  "error": "Unauthorized",
  "status": 401
}