API keys

Create an API key

Create a key. The secret is returned only once.

POST/v1/api-keys

You can also do this on the API keys page of your dashboard.

Authentication

A signed-in session: the cookie from Log in. Changes also need the X-CSRF-Token header.

Body

labelstringoptional

A name for the key, up to 100 characters. It appears in your credit log.

scopesarrayrequired

conversions:read, conversions:write or usage:read.

passwordstringrequired

Your current password, because a key gives lasting access.

Response

201 Created

api_keyobject

id, prefix, label, scopes, created_at, last_used_at, expires_at and revoked_at.

secretstring

The key itself. Store it now.

noticestring

A reminder that the secret won't be shown again.

Errors

Status	Code	What to do
400	`invalid_request`	A scope or the label isn't valid. See `field`.
401	`reauthentication_required`	Your password is wrong.
409	`too_many_api_keys`	Revoke a key first. A workspace can have 25 active keys.
401	`unauthenticated`	Log in first, or log in again.
403	`csrf_failed`	Send the `csrf_token` as `X-CSRF-Token`.

Request

PHPPythonNode.jscURL

<?php
$api = getenv('RASTERNIVO_API_URL') ?: 'https://rasternivo-api.swiftinfocorp.com/v1';
$email = getenv('RASTERNIVO_EMAIL');
$password = getenv('RASTERNIVO_PASSWORD');

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => '', // keep the session cookie between the two requests
]);

// 1. Sign in
curl_setopt_array($ch, [
    CURLOPT_URL => "$api/auth/login",
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode(['email' => $email, 'password' => $password]),
]);
$login = json_decode(curl_exec($ch), true);

// 2. Create the key
curl_setopt_array($ch, [
    CURLOPT_URL => "$api/api-keys",
    CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-CSRF-Token: ' . $login['csrf_token']],
    CURLOPT_POSTFIELDS => json_encode([
        'label' => 'my-server',
        'scopes' => ['conversions:read', 'conversions:write', 'usage:read'],
        'password' => $password, // asked again because a key is a long-lived credential
    ]),
]);
$key = json_decode(curl_exec($ch), true);

echo $key['secret'], "\n"; // shown only once: store it safely

import os
import requests

API = os.environ.get("RASTERNIVO_API_URL", "https://rasternivo-api.swiftinfocorp.com/v1")
email = os.environ["RASTERNIVO_EMAIL"]
password = os.environ["RASTERNIVO_PASSWORD"]

session = requests.Session()  # keeps the session cookie between requests

# 1. Sign in
login = session.post(f"{API}/auth/login", json={"email": email, "password": password})
login.raise_for_status()

# 2. Create the key
r = session.post(
    f"{API}/api-keys",
    headers={"X-CSRF-Token": login.json()["csrf_token"]},
    json={
        "label": "my-server",
        "scopes": ["conversions:read", "conversions:write", "usage:read"],
        "password": password,  # asked again because a key is a long-lived credential
    },
)
r.raise_for_status()

print(r.json()["secret"])  # shown only once: store it safely

const API = process.env.RASTERNIVO_API_URL ?? "https://rasternivo-api.swiftinfocorp.com/v1";
const email = process.env.RASTERNIVO_EMAIL;
const password = process.env.RASTERNIVO_PASSWORD;

// 1. Sign in
const login = await fetch(`${API}/auth/login`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email, password }),
});
if (!login.ok) throw new Error(await login.text());
const { csrf_token } = await login.json();
const cookie = login.headers.getSetCookie().map((c) => c.split(";")[0]).join("; ");

// 2. Create the key
const res = await fetch(`${API}/api-keys`, {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-CSRF-Token": csrf_token, Cookie: cookie },
  body: JSON.stringify({
    label: "my-server",
    scopes: ["conversions:read", "conversions:write", "usage:read"],
    password, // asked again because a key is a long-lived credential
  }),
});
if (!res.ok) throw new Error(await res.text());

console.log((await res.json()).secret); // shown only once: store it safely

API="https://rasternivo-api.swiftinfocorp.com/v1"

# 1. Sign in. The cookie is saved to session.txt; copy csrf_token from the response.
curl -c session.txt -X POST "$API/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'

# 2. Create the key, sending the cookie, the CSRF token and your password again.
curl -b session.txt -X POST "$API/api-keys" \
  -H "Content-Type: application/json" \
  -H "X-CSRF-Token: CSRF_TOKEN_FROM_STEP_1" \
  -d '{"label": "my-server",
       "scopes": ["conversions:read", "conversions:write", "usage:read"],
       "password": "your-password"}'

Response 201

{
  "api_key": {
    "id": "01a19b62-dbe2-7c45-b0ce-5ce02d942a49",
    "prefix": "rn_live_qb3tqt2dfhbn",
    "label": "my-server",
    "scopes": ["conversions:read", "conversions:write", "usage:read"],
    "created_at": "2026-11-02T08:31:49Z",
    "last_used_at": null, "expires_at": null, "revoked_at": null
  },
  "secret": "rn_live_qb3tqt2dfhbn_…",
  "notice": "Copy this key now. It will not be shown again."
}