Authentication

API keys are created per organization in the dashboard on Pro plans and above. Use test keys during development and live keys in production. Keys are shown once at creation and can be revoked at any time.

• rc_test_... for development and staging.
• rc_live_... for production traffic.
• Keys are scoped to a single organization.

Pass your API key as a Bearer token on authenticated requests. Requests without a valid key receive a 401 response.

curl http://localhost:3001/api/v1/forms \
  -H "Authorization: Bearer rc_live_..."

Iframe embeds for contact forms and scheduling do not require an API key. Anyone with the embed URL can load the hosted widget. Enable captcha on sensitive forms to reduce spam.

Webhook payloads include an X-Reachase-Signature header with an HMAC SHA-256 digest of the raw request body. Verify signatures with your webhook secret before processing events. See the webhooks guide for verification examples.