Getting started

Authentication

The API uses Bearer token. One header, sent on every request, scoped to one workspace.

Send your API token in the Authorization header as Bearer <token>.

# Verify the token before wiring anything else up
curl "https://api.redirhub.com/v1/test" \
  -H "Authorization: Bearer $REDIRHUB_TOKEN"

Getting a token

Create a token from the RedirHub dashboard. Tokens belong to a workspace: the workspace that issued the token is the workspace every call operates inside, which is why no request carries a workspace ID.

Rotate rather than share. Issue a separate token per integration. Revoking one then never interrupts the others, and GET /test tells you immediately whether a token is still live.

What a token can reach

A token can do anything the issuing workspace allows, including deleting records in bulk. Treat it like a password: store it in your secret manager, keep it out of source control, and never ship it to a client.

Confirm the workspace a token resolves to with GET /workspace/current, and the account behind it with GET /account.