Authentication
Every request is authenticated with a single header. There are no OAuth flows, sessions, or cookies.
The header
Send your API key in the X-Reseller-API-Key header on every request:
X-Reseller-API-Key: rsl_live_xxxxxxxxxxxxxxxx- Keys always start with the prefix
rsl_live_and are at least 16 characters long. - Keys are bearer credentials — anyone holding the key can spend your wallet. Store it in a secret manager, never commit it, never expose it client-side.
- 1 token = 1 USD; charges come out of your prepaid wallet.
Get a key
- Sign in to the psyke app → API access.
- Create a key with an optional label (e.g.
prod). The plaintext key is returned exactly once at creation — copy it immediately. Only a prefix and a hash are stored, so it cannot be shown again. - Use it as the header value above.
Rotate & revoke
Keys are managed from the same API-access screen. To rotate, create a new key, switch your integration to it, then revoke the old one. Revoking is immediate — a revoked (inactive) key stops authenticating on the next request. Create as many keys as you need (e.g. one per environment); each is scoped to your account.
401 behavior
Two distinct 401 cases exist. Treat any 401 as an auth failure regardless of body shape:
| Case | Body |
|---|---|
Header missing entirely — code INVALID_API_KEY | { "code": "INVALID_API_KEY", "message": "missing or invalid api key" } (no is_error) |
Key malformed / unknown / inactive — code authentication_failed | { "message": "invalid api key", "code": "authentication_failed", "is_error": true } plus header WWW-Authenticate: X-Reseller-API-Key |
The distinction is real (missing header vs. bad key), but for retry logic you only need the status: 401 means fix the credential; do not retry blindly. See the error reference for the full table.