Authentication

Every request is authenticated with a bearer token in the Authorization header.

Authorization: Bearer rk_live_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d

Getting a key

Sign in with your Nizam account — the same account you use for the rest of Al Muslim. If you do not have one, you will be prompted to create one.
Open Keys and create a key, giving it a name you will recognise later ("production", "staging", "my laptop").
Copy it immediately.

A key is shown exactly once

We store only a SHA-256 hash of your key, so we genuinely cannot show it to you again — not through the dashboard, and not if you email us. If you lose it, revoke it and create another.

Keeping keys safe

Never put a key in client-side code. Not in a web page, not in a mobile app binary. Anyone can read it. Call the API from your own server.
Keep keys out of version control. Use environment variables or your platform's secret store.
Use a separate key per environment, so revoking a leaked staging key does not take production down with it.
Revoke immediately if a key may have leaked. Revocation takes effect on the next request.

Test keys

Keys created with the test environment are prefixed rk_test_. They behave identically and draw on the same quota; the prefix exists so you can tell at a glance which key a log line belongs to.