Authenticate with an organization API key.

Ruwana Platform uses one active production API key per organization. The full secret is revealed only when the key is created or regenerated, so store it securely at that moment.

Authorization header

Send the organization key on every public /v1/ request.

Authorization: Bearer $RUWANA_API_KEY

One active key

Each active organization has one active production key. Regeneration replaces the previous secret.

Secret shown once

The full key is available immediately after create/regenerate. Later Platform views expose only safe masked metadata.

Keep it server-side

Do not place a live key in public browser JavaScript, a mobile bundle, source control or logs.

Environment-variable pattern

Shell

export RUWANA_API_KEY="your-key-from-platform"

Node.js

const response = await fetch('https://platform.ruwana.studio/v1/account', {
  headers: { Authorization: 'Bearer ' + process.env.RUWANA_API_KEY }
});
console.log(await response.json());

Python

import os, requests

response = requests.get(
    'https://platform.ruwana.studio/v1/account',
    headers={'Authorization': 'Bearer ' + os.environ['RUWANA_API_KEY']}
)
print(response.json())

401 Unauthorized: a missing or invalid public API credential returns {"ok":false,"error":"api_key_invalid"}. Fix the key rather than retrying the same invalid credential.