API keys
Create, list and revoke RevenueHog API keys for server-to-server feedback ingest, including live and test modes, app binding, scopes and the one-time secret.
API keys authenticate server-to-server writes to the feedback API. They are the only RevenueHog credential meant for your servers. Apps using the SDK enroll with App Attest and need no key.
Key format
| Property | Value |
|---|---|
| Format | rh_live_ or rh_test_ followed by 32 random bytes in base64url |
| Prefix shown in lists | The first 16 characters, for example rh_live_AbCdEfGh… |
| Storage | Only the SHA-256 hash and the prefix are stored. The full secret is shown once. |
| Scopes | feedback:write (the default and only scope today) |
| Binding | One app, or the whole workspace |
Modes
- Live: writes real feedback.
- Test: writes feedback flagged as test, which every read surface hides by default and never posts to Slack.
Create a key in the dashboard
Open settings
Go to Settings and find the API KEYS section.
Name the key
Enter a name in Key name, e.g. Production server (at most 80 characters) and choose LIVE or TEST.
Create and copy
Click Create key. Copy the secret: "Copy this key now. For security it will not be shown again." Click Done.
Each row shows the name, a LIVE or TEST badge, the prefix, when it was last used ("never used" otherwise) and when it was created. Revoke asks "Revoke this key? Any service using it stops working immediately." Revoked keys stay in the list, dimmed and marked Revoked.
Keys can also be minted through the RevenueHog MCP server. See MCP tools.
Management endpoints
These use your session (cookie or Bearer session token), always scoped to your workspace.
List keys
/api/settings/api-keysSession{
"keys": [
{
"id": "…",
"name": "Production server",
"prefix": "rh_live_AbCdEfGh",
"mode": "live",
"appId": null,
"scopes": ["feedback:write"],
"lastUsedAt": "2026-10-27T14:03:11.000Z",
"revokedAt": null,
"createdAt": "2026-10-01T09:00:00.000Z"
}
]
}Newest first, revoked keys included. The secret is never returned.
Create a key
/api/settings/api-keysSessionProp
Type
Response 201:
{ "record": { "id": "…", "name": "Production server", "prefix": "rh_live_AbCdEfGh", "mode": "live", "appId": null, "scopes": ["feedback:write"], "lastUsedAt": null, "revokedAt": null, "createdAt": "…" }, "full": "rh_live_…" }full is the only time the secret is exposed.
| Status | Body |
|---|---|
400 | invalid JSON, missing name, name too long, invalid mode |
401 | unauthorized |
Revoke a key
/api/settings/api-keysSessionBody: { "id": "<key id>" }. Response: { "ok": true }. The key stops authenticating immediately.
| Status | Body |
|---|---|
400 | invalid JSON, missing id |
404 | not found (not your key, or already revoked) |
Handling keys safely
Keep keys on servers only, never in an app binary or client code. Use a test key in staging. Rotate by creating a new key, deploying it, then revoking the old one.
Related
Last updated on
Authentication
How RevenueHog authenticates API calls with App Attest device tokens, the unverified quarantine path, rh_ API keys, sessions and signed store notifications.
SDK API reference
Wire-level reference for every /api/sdk/v1 endpoint, with request bodies, responses, status codes, error messages, CORS rules and the keyless auth model.