Authentication

Overview

All requests are made against https://api.reinterface.com/api/v1. Your API key does not authenticate them directly: you exchange it once at POST /api/v1/token for an access token that is valid for one hour, and send that token in the Authorization header. The same key works across the Email, Calendar, and DNS APIs. Find it under Dashboard → Settings → API keys.

Exchanging once an hour keeps the long-lived key off the wire for almost every call, so it does not accumulate in proxy logs, crash dumps or retained request traces the way a per-request secret does.

curl -X POST https://api.reinterface.com/api/v1/token \
  -H "x-api-key: <API_KEY>"

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

-H "Authorization: Bearer <ACCESS_TOKEN>"

Example request

curl "https://api.reinterface.com/api/v1/dns/records?domain=company.com" \
  -H "Authorization: Bearer <ACCESS_TOKEN>"

Expiry and rotation

Keys expire 180 days after they are created, and the expiry date is shown next to each key in Settings. You can hold two live keys at once, so rotating never takes your integration offline: create the new key, deploy it, then revoke the old one. Creating a third key retires the oldest automatically.

A key is shown once, when it is created. We store only a SHA-256 hash of it, so it cannot be recovered afterwards. If you lose a key or believe it has leaked, revoke it and create a new one. Revoking a key stops it buying new tokens immediately; any token already issued from it stops working within the hour.

Security