Authentication

Authentication Methods

RadMah AI supports two authentication methods for the Client API:

API Keys

API keys are the recommended authentication method for programmatic access. Keys use the sl_live_ prefix followed by a 32-character hex suffix.

Creating an API Key

Navigate to Settings → API Keys in the client dashboard, or use the REST API:

curl -X POST https://api.radmah.ai/v1/client/api-keys \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <access_token>" \
  -d '{ "name": "CI Pipeline Key" }'

Using an API Key

from radmah_sdk import RadMahClient

client = RadMahClient(api_key="sl_live_abc123...")

Key Management

API keys are scoped to a tenant. You can create multiple keys with descriptive names and revoke them individually. Revoked keys are immediately invalid across all API calls.

JWT Sessions

JWT tokens are used for browser-based sessions in the client dashboard.

Login Flow

curl -X POST https://api.radmah.ai/v1/client/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "..."
  }'

Multi-Factor Authentication

MFA uses TOTP (RFC 6238) with 30-second windows and 6-digit codes. When MFA is enabled on an account, it is enforced at every login and cannot be bypassed.

• Enroll via Settings → Security in the client dashboard
• Backup codes are generated at enrollment and stored hashed
• Compatible with any TOTP authenticator app (Google Authenticator, Authy, 1Password, etc.)

SSO (Enterprise)

Enterprise and Sovereign plans support SAML 2.0 and OIDC single sign-on, configured per tenant. SSO is combined with SCIM 2.0 for automated user provisioning and deprovisioning. See SSO & SCIM for configuration details.

BYO API Key (LLM Providers)

Tenant Roles

Security Best Practices