Business Guide
API Keys and Security
How business API keys are validated and safely used in integrations.
Accepted Credential Formats
SDK endpoints accept API keys via:
x-refkit-api-keyx-api-keyAuthorization: Bearer <key>
Origin Restrictions
If a key has allowedOrigins configured, requests are rejected unless origin/referer matches one of the allowed origins.
Key Lifecycle Endpoints
- Create key:
POST /business/api-keys - Rotate key:
POST /business/api-keys/:apiKeyId/rotate - Revoke key:
DELETE /business/api-keys/:apiKeyId
Revoked keys are blocked immediately during middleware validation.
Operational Guidance
- Use
TESTenvironment keys outside production. - Keep key rotation part of deployment hygiene.
- Avoid exposing long-lived LIVE keys in client-only bundles without origin restrictions.