Authentication

Authentication methods

Navigate to Settings → API Keys in the client dashboard and click Create Key. Copy the key immediately — it is only shown once.

Pass the key via the X-API-Key header, or use the SDK which handles this automatically.

from radmah_sdk import RadMahClient

# API key — passed as X-API-Key header automatically
client = RadMahClient(api_key="sl_live_your_key_here")

# Verify authentication
health = client.health()
print(f"Connected: {health.status}")

JWT Authentication

For browser-based applications, authenticate with email and password to receive a JWT token. Tokens expire after 24 hours and can be refreshed.

import httpx

# Login to get a JWT token
response = httpx.post(
    "https://api.radmah.ai/v1/client/auth/login",
    json={
        "email": "you@company.com",
        "password": "your_password"
    }
)
token = response.json()["access_token"]

# Use the token with the SDK
client = RadMahClient(api_key=token)

Key management

The workspace owner and admins create, rotate and revoke API keys; members and viewers cannot (they see their own keys and ask an owner or admin for one). A key acts with the role of the person it was created for: an owner or admin creates a key for themselves, or for an active member whose role is below theirs (create_api_key(name, for_email=...),rady keys create NAME --for EMAIL, or "For" on the Keys page), and that key acts with the member's role. Rotation revokes the old key at once and the replacement acts exactly as the old key did (same person, scopes, rate limit and IP allowlist). Rotating or revoking a key needs the caller to be its person or to outrank them: the owner any key, an admin their own and those of members and viewers, never another admin's or the owner's. If a person leaves the workspace their keys are revoked; if they change their e-mail address their keys move with them.

A key holds one of two scopes. client:* (the default) does everything its person may do. client:read is read-only: it reads everything its person may read and changes nothing. Every route that writes or spends refuses it with 403 FORBIDDEN,detail.reason API_KEY_READ_ONLY: creating, changing or deleting anything, starting work that spends credits, and the connector health check (it tests each connector against your systems and records the result). Create one withcreate_api_key(name, scopes=["client:read"]) orPOST /v1/client/api-keys with {"scopes": ["client:read"]}.

Security best practices

Next steps