Authentication & API Key Management
Secure your REST API integrations with SHA-256 hashed API keys, HTTP header authentication, and zero-downtime key rotation.
Direct Authentication Specification
RSFlowHub authenticates API calls via the x-api-key HTTP header (or standard Authorization: Bearer <KEY>). API keys are prefixed with rsh_live_ and validated against SHA-256 hashes stored in the gateway. Secret keys must remain strictly on server-side backends and never be embedded into client-side JavaScript or mobile bundles.
Passing the Authentication Header
Every incoming request must include your active secret API key. We support both custom and standard header conventions:
Include the key directly in the x-api-key header:
POST /api/v1/ai/intent-detection HTTP/1.1
Host: apis.rsflowhub.com
Content-Type: application/json
x-api-key: rsh_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxOr pass it as a Bearer token in the Authorization header:
POST /api/v1/ai/intent-detection HTTP/1.1
Host: apis.rsflowhub.com
Content-Type: application/json
Authorization: Bearer rsh_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxCode Examples by Language
curl -X POST https://rsflowhub.com/api/v1/ai/intent-detection \
-H "x-api-key: $RSFLOWHUB_API_KEY" \
-H "Content-Type: application/json" \
-d '{"text": "Upgrade my account to enterprise tier"}'import os
import requests
api_key = os.environ.get("RSFLOWHUB_API_KEY")
url = "https://apis.rsflowhub.com/api/v1/ai/intent-detection"
headers = {
"x-api-key": api_key,
"Content-Type": "application/json"
}
payload = {
"text": "Upgrade my account to enterprise tier"
}
response = requests.post(url, headers=headers, json=payload, timeout=5.0)
print(response.json())const apiKey = process.env.RSFLOWHUB_API_KEY;
const response = await fetch('https://apis.rsflowhub.com/api/v1/ai/intent-detection', {
method: 'POST',
headers: {
'x-api-key': apiKey,
'Content-Type': 'application/json'
},
body: JSON.stringify({
text: 'Upgrade my account to enterprise tier'
}),
signal: AbortSignal.timeout(5000) // 5s timeout
});
const data = await response.json();
console.log(data);Zero-Downtime Key Rotation Protocol
In production architectures, security keys should be rotated periodically or immediately upon potential team member offboarding. RSFlowHub allows multiple concurrent active keys to achieve zero downtime:
1. Generate Secondary Key
In Dashboard → API Keys, create a secondary API key with a descriptive label (e.g. prod-worker-2026-v2).
2. Update Application Config
Deploy the new key to your environment secret manager (e.g. AWS Secrets Manager, Vault, or Kubernetes Secret) and perform rolling restarts.
3. Verify Traffic Ingress
Inspect incoming logs in your application monitoring to ensure traffic is flowing successfully under the new credential.
4. Revoke Deprecated Key
Return to the RSFlowHub dashboard and delete or deactivate the retired key. The revocation takes effect immediately across edge nodes.
Never check API keys into version control repositories. Add
.env to your .gitignore and always store credentials in server environment variables.