Authentication

The Reignitor API uses API keys. Each key belongs to one account and acts as that account: it spends that account’s credits and sees only that account’s jobs.

Create a key

API keys are part of the Agency plan.

1. Sign in to Reignitor.
2. Open Account > API keys (/app/account/api-keys).
3. Under Create new key, type a label you will recognise later, such as CI pipeline or CMS sync.
4. Select Create.
5. Copy the key straight away.

The key is shown once

Reignitor stores only a hash of your key. The full key is shown once, when you create it. If you lose it, revoke it and create a new one.

A key looks like this: emp_ followed by 64 hexadecimal characters.

Send the key

Put the key in the Authorization header as a Bearer token on every request:

curl https://reignitor.com/v1/me \
  -H "Authorization: Bearer $REIGNITOR_API_KEY"

A valid key returns 200 with your account:

{
  "user_id": "3f1c2a9e-8b7d-4c1e-9f0a-2d6b5e4c3a21",
  "email": "dev@example.com",
  "name": "Sam",
  "credits_remaining": 42
}

When a key is refused

Status	code	Meaning
401	NO_API_KEY	No Authorization header, or the token does not start with emp_.
401	INVALID_API_KEY	The key is unknown or has been revoked.
402	PLAN_UPGRADE_REQUIRED	The key is valid, but the account is not on the Agency plan.
403	ACCOUNT_SUSPENDED	The account that owns the key is suspended.

If an account leaves the Agency plan, its keys stop working until it is back on Agency.

Keep keys secret

• Store keys in a secret manager or environment variable. Never commit them to source control.
• Call the API from your server only. Never ship a key in a web page or mobile app. Browser requests to the API are not allowed by its CORS policy anyway.
• Use one key per system, with a clear label. Then you can revoke one without breaking the others.
• The API keys screen shows when each key was last used. A key you do not recognise, or one used when it should not be, should be revoked.

Revoke a key

1. Open Account > API keys.
2. Under Active keys, find the key by its label.
3. Select the Revoke key (bin) icon.

A revoked key is refused at once with 401 INVALID_API_KEY. Revoking cannot be undone. Renders already started with the key keep running.