Create an API key
Sign in and open API keys. Create a key, choose scopes and lifetime, and complete passkey step-up.
The browser generates an Ed25519 key pair and sends RC only the public key. The private key is shown once as rcsk_<key-id>_<pkcs8-private-key-base64url>. RC cannot recover it later.
API keys default to until revoked. Finite lifetimes are 1 hour, 1 day, 7 days, 30 days, 90 days, 180 days, and 1 year.
Scopes
| Scope | Allows |
|---|---|
read | GET requests to account, workspace, device, and process resources. |
execute | Allocate device processes for remote execution. |
manage-devices | Create enrollments and modify or remove devices. |
manage-workspaces | Create or modify workspaces. |
Passkey and API-key administration require a human browser session and cannot be performed with an API key.
Request headers
X-RC-Key-ID | The key ID from the rcsk_ credential. |
|---|---|
X-RC-Timestamp | Current Unix time in seconds. RC accepts a 60-second clock window. |
X-RC-Nonce | A new random value for every request. Reuse is rejected. |
X-RC-Signature | Base64url Ed25519 signature of the canonical payload. |
Canonical payload
rc-api-v1
<key-id>
<unix-timestamp-seconds>
<nonce>
<HTTP-METHOD>
<path-and-query>
<hex-sha256-body><path-and-query> is the request URI beginning with /. <hex-sha256-body> is the lowercase hexadecimal SHA-256 digest of the exact request body bytes. Hash zero bytes for an empty body.
The signature is Ed25519 over the UTF-8 bytes of that newline-delimited payload.
Use an API key with the RC CLI
RC_API_TOKEN='rcsk_...' rc devicesrc devices --token 'rcsk_...'The CLI parses the private key from the rcsk_ credential and signs each request locally. It does not transmit the private key as a bearer token.
OpenAPI reference
The generated OpenAPI schema contains the public API routes, request/response schemas, and proof-of-possession security scheme.
Authenticated requests still require a valid RC proof-of-possession signature. The reference does not receive or store your API private key.