Live
API SHAPESAPI keys & rotation
Create and revoke keys yourself — no ticket needed. Dashboard → API Keys, or Settings → API keys (my.rii.link/settings/api-keys); only workspace owners and admins can manage them. A key belongs to the workspace, not to whoever created it, so it keeps working if that person leaves the team.
WHAT EXISTS TODAY
→Create with a name, an environment (Live rii_live_, or Test rii_test_ — test keys run in a separate sandbox: their links never redirect real traffic and don’t count toward the plan), and an access level: Read and write, or Read only→Read only reads the links, domains and QR codes created through the API, plus per-link stats; Read and write can also create, update and delete links, add and remove domains, and create QR codes→The full key is shown once — rii.link stores only a hash, so a lost key can’t be recovered; revoke it and create a new one. After that the list shows a masked prefix, environment, access, created, last used, and status→At most 2 active keys per workspace. Rotate by creating the replacement, deploying it, then revoking the old one — in that order→Revoking is immediate and can’t be undone: integrations on the old key start getting 401 until you give them a new one; revoked keys stay listed as Revoked→Use it as Authorization: Bearer rii_live_… against https://api.rii.link/v1 — keep it server-side, never in a browser or a public repo
Authentication in the reference→ API · Authentication
The header, the prefixes, and the 401 you get when rotation goes wrong.