How API keys work · Rebilder Help

What a key looks like

Every site gets its own API key: the prefix rblr_ followed by 48 random characters. The prefix makes a leaked key easy to recognize in code or logs, and easy to talk about with support.

Create and store your API key

The full API key is displayed once when created. Rebilder stores its hash for authentication. Copy the key into your server configuration and keep it private.

What a key can and cannot do

• Can: authenticate event reporting. The gateway sends visit events to Rebilder’s POST /v1/events endpoint with the key as a Bearer token, and those events fill AI visits in the Console.
• Can: report orders through the outcomes API and retrieve approved Answers Hub entries through the export API. A site key does not sign you in to the Console or change account settings.
• Cannot: write another site’s events. The site is always resolved from the key itself, never from the request body.