Authentication

Every request carries your key in the Authorization header.

Authorization: Bearer rv_…

A key belongs to one account and can do what that account can on the site: read its data, list and buy items, spend its balance. Keep it on your server, and out of repositories and client apps.

Getting a key

Make it on the API key page. An account has one key. Rockvel shows it once and keeps only a hash of it, so a lost key can't be restored, only replaced. A new key ends the old one at once, and so does deleting it.

What a key can't do

Sign in, or make, replace and delete keys. These take a browser signed in through Steam, so a stolen key can't lock you out: delete it on the site and it stops working at once.

When a key is refused

A missing or unknown key gets 401 with WWW-Authenticate: Bearer. A session cookie doesn't count here: the site and the API are separate ways in.