Authentication

Every request except the catalog needs an API key, sent as a bearer token:

Authorization: Bearer rv_7KQ2M9XD…

Create keys in Settings, API keys. A key is shown once, so store it like a password. Give each script or agent its own key, set an expiry if it’s temporary, and revoke it at any time. Everything a key does appears in the server’s activity with the key’s name.

Scopes

A key can only do what its scopes allow. New keys get read, credentials and power.

readSee servers, their status and activity, payments, prices and the balance

credentialsSee server passwords (in Get a server)

powerStart, stop and restart servers

orderOrder servers, paid from the balance

renewRenew servers from the balance and switch auto-renew

topupCreate crypto invoices to top up the balance

reinstallReinstall servers (erases them)

deleteDelete servers

Sign-in settings, support, affiliates and key management can’t be reached with a key, whatever its scopes. If a balance is frozen, keys can’t spend it either.