Skip to main content
Every request to the Recotap External API must be authenticated using an API key. The key is passed as a custom HTTP header on every request. Requests without a valid key are rejected with 401 Unauthorized.

​
Required header

Include your API key in the X-Api-Key header on every request:
For example, using cURL:
The API key is tied to your individual user account, not the team or workspace. Store it in a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.) and never expose it in client-side code, browser requests, or version control.

​
Generating your API key

API keys are managed from the Tech Settings section of your Recotap workspace. Each user account holds one active key at a time. Generating a new key immediately replaces the previous one. You can navigate directly to the API Access Key page or follow the steps below.
1

Open Settings

Click the gear icon in the top-right corner of the Recotap navigation bar.
2

Go to Workspace

In the dropdown, click Workspace (Set up and customize).
3

Navigate to Tech Settings → API Access Key

In the left sidebar, click Tech Settings, then select API Access Key.
4

Generate the key

Click + Generate API Key.
5

Copy and store it securely

Your new API key is displayed under Your New API Key. Click Copy to copy the full key, then store it in your secrets manager before closing the page.
The full key is shown only once immediately after generation. Once you navigate away, the page reverts to the generation screen and no part of the key is displayed again. If you lose the key, you must generate a new one, which immediately invalidates the previous key.

​
Key behaviour

Keys are user-scoped. Every Recotap user generates and manages their own independent key. No other user — including workspace admins — can view or manage your key. Regenerating your key does not affect any other user’s key.

​
Error responses

If a request is rejected due to an authentication issue, Recotap returns 401 Unauthorized with a JSON body describing the problem.