Authentication and API Keys
Every request to the public API, from the SDK or over REST, carries an API key as a bearer token:
Authorization: Bearer <api-key>
Creating a key
API keys are managed under Settings → Organization → API keys (app.requiply.com/settings/org/api-keys). Only members with the Admin role see this page.
- Click Create key.
- Enter a Name that says where the key is used, for example Lovable site or Accounting sync.
- Choose the Type: Publishable or Secret.
- Click Create key, then copy the key from the Save this key now dialog.
The table lists each key with its name, type, a masked Key (prefix and last four characters, enough to tell keys apart), when it was created, and when it was Last used. The pencil renames a key. The ban icon revokes it: a revoked key stops working immediately and cannot be restored. Turn on Show revoked to see revoked keys.
Choosing the key type
Publishable key (rq_pk_…) | Secret key (rq_sk_…) | |
|---|---|---|
| Where it goes | Browser code, a website, a mobile app | Server code and environment variables only |
| Organization info, catalog, services | Yes | Yes |
| Availability and quotes | Yes | Yes |
| Bookings | Booking requests only (asRequest: true) | Create, list, read, add notes |
| Goods for sale | Browse and add to a booking request, while the organization sells to customers | Everything in Sales |
| Clients, reports, inventory status, organization summary | No | Yes |
| Supplier-sourced subrental products | Never | When Subrentals is on |
| Booking cost adjustments, bookings outside working hours | No | Yes |
The full list by endpoint is in the REST API Reference.
Publishable keys
A publishable key is visible to anyone who opens your page source, and the API accepts it from any origin. What keeps it safe is its scope: it reads the catalog, prices quotes, and sends booking requests that staff approve in the app. It never sees client records or reports, never holds inventory on its own, and cannot buy goods beyond the stock on hand. If a key is abused, revoke it and create a new one.
const requiply = new RequiplyClient({ apiKey: 'rq_pk_live_...' });
Secret keys
A secret key acts for the whole organization, not for a team member. Keep it in server-side code and environment variables:
REQUIPLY_SECRET_KEY=rq_sk_live_...
const requiply = new RequiplyClient({
apiKey: process.env.REQUIPLY_SECRET_KEY!,
});
NEXT_PUBLIC_… or NUXT_PUBLIC_….The SDK refuses an rq_sk_ key in a browser. It has a dangerouslyAllowSecretKeyInBrowser override for local tools, which production integrations should never set.
Rate limits
Each key can make 100 requests per minute. Further requests get 429 with a Retry-After header in seconds, which the SDK exposes as RequiplyError.retryAfter. Browsers cannot read that header across origins, so a storefront should wait a few seconds before retrying. See Error Handling.
Cross-origin requests
The public API answers requests from any origin, so there is no domain to register. Browsers may send the Authorization, Accept, and Content-Type headers; a cross-origin request with another custom header is blocked before it reaches Requiply.
No test mode
Every key works on real data. For interactive documentation and demos, use a publishable key from a demo organization, and point anything that creates bookings or sales at an organization whose records you can delete.
AI agents and MCP
The same secret key also opens Requiply's MCP server to an agent you build yourself. Send it as a bearer token to https://api.requiply.com/api/mcp. The agent gets the organization-wide tools a secret key allows; writes still go through the preview-then-confirm step described on that page. Assistants such as Claude and ChatGPT connect with OAuth instead and need no key. Publishable keys cannot open the MCP server.