Skip to main content
All API requests require authentication using an API key.

​
API Key

Include your API key as a Bearer token in the Authorization header:
API keys are project-scoped. Each key grants access to resources within a single project. A key has full access to the project’s endpoints unless it is restricted to a list of scopes. See Scopes.

​
API Versioning

Include the Reap-Version header in every request to specify which API version to use:
The version uses a date-based format (YYYY-MM-DD). Requests without this header will be rejected.

​
Example

​
Environments

https://sandbox.api.reap.global and https://prod.api.reap.global remain valid aliases for Singapore. API keys are scoped to a single environment. A sandbox key cannot be used against production and vice versa.

​
IP allowlist

Each key can optionally be restricted to a list of IPv4/IPv6 addresses or CIDR ranges. An empty list means the key works from any IP. When a list is set, requests from any other address are rejected with 403 and code API_KEY_IP_NOT_ALLOWED. Reap uses the last X-Forwarded-For hop (the address the load balancer saw). If that hop is missing, the request is also rejected.
Create and revoke your project’s API keys in the dashboard, and set each key’s scopes and IP allowlist there.