Security & Authentication

Authentication & API Key Guide

All requests to RSFlowHub API endpoints require header authentication using your secret API Key.

Setting the Authentication Header

Pass your API key in the custom HTTP request header named x-api-key. Never commit secret keys to public git repositories or expose them in browser client-side code.

POST /api/v1/intent/detect HTTP/1.1
Host: rsflowhub.com
x-api-key: rsh_live_xxxxxxxxxxxxxxxxxxxx
Content-Type: application/json
Keep your secret key safe. Use environment variables (e.g. RSFLOWHUB_API_KEY) in your backend code.

Security Best Practices

  • Server-Side Proxy: Route API calls through your backend server rather than directly calling from frontend apps.
  • Key Rotation: Regularly rotate keys or revoke compromised keys immediately in your dashboard.
  • Environment Isolation: Use separate keys for Development, Staging, and Production environments.
  • Rate Limits: Each key is protected by adaptive rate limiting to prevent abuse.