Authentication
Every Renidly request is authenticated with a single header. No OAuth, no token refresh — one long-lived key, sent on every call, across every product surface.
Renidly uses a long-lived API key. The same key authenticates every surface — there is just one header to remember: X-renidly-apikey. There is no Bearer prefix, and the header name is case-insensitive.
Open Workspace → API Keys
Sign in, open Workspace → API Keys, and copy your key. Store it in a secret manager (1Password, Doppler, Vault, AWS Secrets Manager) or your runtime's environment — never in source control.
The X-renidly-apikey header
Add the header to any request. Here is a real, billable call — looking a person up by their public handle:
curl "https://renidly.com/api/data/v1/people/profile?handle=ryanroslansky" \
-H "X-renidly-apikey: $RENIDLY_API_KEY"A working key returns the standard envelope
Success comes back with success: true and your payload in data. Every endpoint shares this shape — see the Response Envelope.
{
"success": true,
"statusCode": 200,
"message": "Profile retrieved successfully",
"errors": null,
"data": {
"id": "prsn_06d0d44dogo2m",
"handle": "ryanroslansky"
/* …the rest of the record */
}
}curl https://renidly.com/api/panel/credits/tier/k/ \
-H "X-AUTHAPI-Key: $RENIDLY_API_KEY"Something went wrong?
A rejected key comes back with success: false and the reason in message. A missing key is a 401; a recognised-but-invalid key is a 403.
{
"success": false,
"message": "API key required",
"data": null,
"errors": null
}| Issue | Fix |
|---|---|
| Wrong header name | Use X-renidly-apikey — no Bearer prefix, no Authorization header. |
| Typo or truncated key | Re-copy the full value from API Keys. |
| Rotated key | After a rotation every integration needs the new value. Rotate again from API Keys if you suspect a leak. |
| Wrong workspace | A key only works for the workspace it was issued in. See API Keys & Workspaces. |
Keep your key safe
Treat API keys like database credentials. Concrete practices we recommend:
- Never commit keys. Use environment variables, not source code. A pre-commit secret scanner is cheap insurance.
- Never expose keys client-side. Browser JavaScript, mobile apps, and extensions are all readable by the user. Proxy through your backend.
- Rotate on suspicion. Revoke immediately if a teammate leaves, a laptop is lost, or you find the key in a log.
- Monitor usage. Watch the dashboard for unexpected spikes — usually the first signal a key has leaked.
export RENIDLY_API_KEY="your_api_key_here"