---
title: "Authentication and API Keys"
description: "Create, name, and revoke Requiply API keys, choose between a publishable key for browser storefronts and a secret key for servers, and learn the rate limit."
canonical_url: "https://requiply.com/docs/en/developers/authentication-and-api-keys"
---
# Authentication and API Keys

> Create, name, and revoke Requiply API keys, choose between a publishable key for browser storefronts and a secret key for servers, and learn the rate limit.

Every request to the public API, from the SDK or over REST, carries an API key as a bearer token:

```http
Authorization: Bearer <api-key>
```

## Creating a key

API keys are managed under **Settings → Organization → API keys** ([app.requiply.com/settings/org/api-keys](https://app.requiply.com/settings/org/api-keys)). Only members with the **Admin** role see this page.

1. Click **Create key**.
2. Enter a **Name** that says where the key is used, for example *Lovable site* or *Accounting sync*.
3. Choose the **Type**: **Publishable** or **Secret**.
4. Click **Create key**, then copy the key from the **Save this key now** dialog.

<warning>

The full key is shown only once. If you lose it, create a new key and revoke the old one.

</warning>

The table lists each key with its name, type, a masked **Key** (prefix and last four characters, enough to tell keys apart), when it was created, and when it was **Last used**. The pencil renames a key. The ban icon revokes it: a revoked key stops working immediately and cannot be restored. Turn on **Show revoked** to see revoked keys.

## Choosing the key type

<table>
<thead>
  <tr>
    <th>
      
    </th>
    
    <th>
      Publishable key (<code>
        rq_pk_…
      </code>
      
      )
    </th>
    
    <th>
      Secret key (<code>
        rq_sk_…
      </code>
      
      )
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Where it goes
      </strong>
    </td>
    
    <td>
      Browser code, a website, a mobile app
    </td>
    
    <td>
      Server code and environment variables only
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Organization info, catalog, services
      </strong>
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Availability and quotes
      </strong>
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Bookings
      </strong>
    </td>
    
    <td>
      Booking requests only (<code>
        asRequest: true
      </code>
      
      )
    </td>
    
    <td>
      Create, list, read, add notes
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Goods for sale
      </strong>
    </td>
    
    <td>
      Browse and add to a booking request, while the organization <a href="https://requiply.com/docs/en/developers/typescript-sdk/sales#with-a-publishable-key">
        sells to customers
      </a>
    </td>
    
    <td>
      Everything in <a href="https://requiply.com/docs/en/developers/typescript-sdk/sales">
        Sales
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Clients, reports, inventory status, organization summary
      </strong>
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Supplier-sourced subrental products
      </strong>
    </td>
    
    <td>
      Never
    </td>
    
    <td>
      When Subrentals is on
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Booking cost adjustments, bookings outside working hours
      </strong>
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Yes
    </td>
  </tr>
</tbody>
</table>

The full list by endpoint is in the [REST API Reference](https://requiply.com/docs/en/developers/api-reference#endpoints).

### Publishable keys

A publishable key is visible to anyone who opens your page source, and the API accepts it from any origin. What keeps it safe is its scope: it reads the catalog, prices quotes, and sends booking requests that staff approve in the app. It never sees client records or reports, never holds inventory on its own, and cannot buy goods beyond the stock on hand. If a key is abused, revoke it and create a new one.

```ts
const requiply = new RequiplyClient({ apiKey: 'rq_pk_live_...' });
```

### Secret keys

A secret key acts for the whole organization, not for a team member. Keep it in server-side code and environment variables:

```bash
REQUIPLY_SECRET_KEY=rq_sk_live_...
```

```ts
const requiply = new RequiplyClient({
  apiKey: process.env.REQUIPLY_SECRET_KEY!,
});
```

<caution>

Never commit real API keys to Git, paste secret keys into browser code, or expose them through public environment variables such as `NEXT_PUBLIC_…` or `NUXT_PUBLIC_…`.

</caution>

The SDK refuses an `rq_sk_` key in a browser. It has a `dangerouslyAllowSecretKeyInBrowser` override for local tools, which production integrations should never set.

## Rate limits

Each key can make 100 requests per minute. Further requests get `429` with a `Retry-After` header in seconds, which the SDK exposes as `RequiplyError.retryAfter`. Browsers cannot read that header across origins, so a storefront should wait a few seconds before retrying. See [Error Handling](https://requiply.com/docs/en/developers/typescript-sdk/error-handling#rate-limits).

## Cross-origin requests

The public API answers requests from any origin, so there is no domain to register. Browsers may send the `Authorization`, `Accept`, and `Content-Type` headers; a cross-origin request with another custom header is blocked before it reaches Requiply.

## No test mode

Every key works on real data. For interactive documentation and demos, use a publishable key from a demo organization, and point anything that creates bookings or sales at an organization whose records you can delete.

## AI agents and MCP

The same secret key also opens Requiply's [MCP server](https://requiply.com/docs/en/ai/mcp) to an agent you build yourself. Send it as a bearer token to `https://api.requiply.com/api/mcp`. The agent gets the organization-wide tools a secret key allows; writes still go through the preview-then-confirm step described on that page. Assistants such as Claude and ChatGPT connect with OAuth instead and need no key. Publishable keys cannot open the MCP server.


## Sitemap

See the full [sitemap](https://requiply.com/docs/sitemap.md) for all pages.