# Auth.md — reAPI Authentication

reAPI uses API-key Bearer authentication for its public HTTP API.

## Base URL

```
https://reapi.ai/api/v1
```

## Bearer Token

Send an API key on every API request:

```http
Authorization: Bearer rk_live_xxxxxxxxxxxxxxxx
```

Create API keys in the dashboard at:

https://reapi.ai/dashboard/api-keys

Keys are shown once. Store them in a secret manager or an environment variable
such as `REAPI_API_KEY`.

## Request Pattern

Generation endpoints are asynchronous:

1. Submit a job, for example `POST /api/v1/images/generations`.
2. Store the returned task id.
3. Poll `GET /api/v1/tasks/{id}` every 1-2 seconds until `completed` or
   `failed`.

## Important Behavior

- Every successful POST creates a new task and charges credits.
- `Idempotency-Key` is accepted for telemetry but does not deduplicate tasks.
- Failed tasks are refunded automatically when the workflow ends in failure.
- Rate limit defaults to 20 requests per second per user.

## Common Errors

| HTTP | Code | Meaning |
| --- | --- | --- |
| 401 | 10001 | Missing `Authorization` header |
| 401 | 10002 | Header is not `Bearer <key>` |
| 401 | 10003 | Invalid API key |
| 401 | 10004 | Revoked API key |
| 402 | 30001 | Insufficient credits |
| 429 | 50001 | Rate limit exceeded |

Error responses include a `request_id`. Include it in support requests.

## References

- API overview: https://reapi.ai/docs/api
- Quickstart: https://reapi.ai/docs/api/quickstart
- Full authentication docs: https://reapi.ai/docs/api/authentication
- Error catalog: https://reapi.ai/docs/api/errors