Authentication

API keys

Create and manage API keys from your API Keys page in the dashboard. Keys are tied to your organization.

There are two kinds:

Build against a sandbox key, then swap it for a live one -- nothing else about the request changes. See the Sandbox guide for what it covers.

Header format

Include your API key in every request using the Authorization header:

Authorization: Bearer sk_live_YOUR_API_KEY

Example request

curl -X POST "https://api.redpine.ai/api/v1/search/query" \
  -H "Authorization: Bearer sk_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"collection": "my-collection", "query": "search text"}'

Key scoping

API keys can be scoped to control access:

• Organization-wide -- access all collections in your organization.
• Collection-specific -- restrict access to one or more named collections. Requests to other collections return 403.

Authentication errors

If the API key is missing or invalid, the API returns 401 Unauthorized:

{
  "error": {
    "code": "AUTHENTICATION_REQUIRED",
    "message": "Invalid or missing API key",
    "request_id": "req_a1b2c3d4"
  }
}

If the key is valid but lacks access to the requested collection, the API returns 403 Forbidden.

If a sandbox key reaches an endpoint that has no sandbox behaviour, the API returns 403 SANDBOX_UNSUPPORTED_ENDPOINT rather than serving real data.

Security best practices

• Never expose API keys in client-side code or public repositories.
• Use collection-scoped keys when possible to limit blast radius.
• Rotate keys periodically and revoke unused keys.
• Store keys in environment variables or a secrets manager.