Authentication

Every request to the Reecall API must include an API key. You pass it as a Bearer token in the Authorization header, no OAuth flows, no session cookies, just a single key.

All IDs and tokens in the examples below are placeholders.

Getting your first API key

Your first API key is created in the Reecall dashboard. Log in at dashboard.reecall.com, navigate to Settings > API Keys, and create a new key. Once you have it, you can use the API to create additional keys programmatically.

Using your API key

Send the key as a Bearer token in the Authorization header on every request:

GET /data_next/ai/LLM/
Authorization: Bearer {your-api-key}

Creating an API key

Create a new API key through the Data API:

POST /data_next/core/apiKeys/
Authorization: Bearer {your-api-key}
Content-Type: application/json

{
  "comment": "My new API key"
}

{
  "id": "{api-key-id}",
  "comment": "My new API key",
  "token": "{generated-api-key-token}",
  "projectId": null,
  "organizationId": "{organization-id}",
  "createdAt": "2025-01-15T10:30:00.000Z",
  "updatedAt": "2025-01-15T10:30:00.000Z"
}

Scopes

API keys can be scoped at two levels:

Organization-scoped key

When you create a key without specifying a projectId, it is scoped to your entire organisation. This key can read and write resources across all projects.

POST /data_next/core/apiKeys/
Authorization: Bearer {your-api-key}
Content-Type: application/json

{
  "comment": "Org-wide production key"
}

Project-scoped key

To restrict a key to a single project, pass the projectId:

POST /data_next/core/apiKeys/
Authorization: Bearer {your-api-key}
Content-Type: application/json

{
  "comment": "Project-specific key",
  "projectId": "{project-id}"
}

Project-scoped keys can only access resources belonging to that project. Use them to limit the blast radius of a key compromise.

Managing API keys

List all keys:

GET /data_next/core/apiKeys/
Authorization: Bearer {your-api-key}

Delete a key:

DELETE /data_next/core/apiKeys/{api-key-id}
Authorization: Bearer {your-api-key}

Error responses

When authentication fails, the API returns a 403 status with the following body:

{
  "message": "UNAUTHORIZED",
  "code": "UNAUTHORIZED",
  "status": 403,
  "context": {
    "required": "AUTHENTICATED",
    "current": "EVERYONE"
  }
}

Common causes:

• Missing Authorization header - the header is required on every request
• Invalid token - the key does not exist or has been deleted
• Wrong scope - a project-scoped key trying to access a resource in a different project

Best practices

• Use project-scoped keys in production to limit access to what is needed
• Use Variables to store sensitive values like API keys for MCP server configurations