Authentication

Every request needs an API key. Keys belong to your workspace and act for it.

Create a key

Sign in to RecovAI as a workspace administrator.
Open Settings → Developer API and choose Create key.
Give the key a name that says what uses it, for example Servicing sync. The name appears on the case timeline next to every change the key makes.
Copy the key. It is shown once and cannot be retrieved later. If you lose it, revoke it and create a new one.

Keys look like this (this one is fake):

rk_0123456789abcdef0123456789abcdef01234567

rk_ followed by 40 hexadecimal characters. In the key list RecovAI only shows the first few characters, so you can tell keys apart.

Send the key

Put the key in the X-API-Key header:

curl https://api.recovai.ai/cases \
  -H "X-API-Key: $RECOVAI_API_KEY"

An Authorization: Bearer header works too:

curl https://api.recovai.ai/cases \
  -H "Authorization: Bearer $RECOVAI_API_KEY"

What a key can do

A key acts as an operational team member of your workspace. It can create and update cases, upload documents, record recoveries, manage tasks and run the case pipeline.

It cannot:

Not allowed	Error
Send letters, emails, secure response rooms or cloud copies	`403 interactive_user_required`
Approve legal reviews, packet reviews or redaction reviews	`403 review_required`
Close or reopen cases, place legal holds, decide deletion requests	`403 review_required`
Manage settings, users, integrations or API keys	`403`

Revoke a key

In Settings → Developer API, choose Revoke next to the key. It stops working immediately; requests with it get 401 invalid_api_key. The key stays in the list, marked revoked, for your audit trail.

Authentication errors

Status	`error`	Meaning
401	`unauthorized`	No key was sent.
401	`invalid_api_key`	The key is wrong, malformed or revoked.
401	`invalid_token`	An `Authorization: Bearer` value was sent that is not an API key (keys start with `rk_`).
403	`interactive_user_required`	The action needs a signed-in person.