Auth And API Keys

Creating an API key

In Rooaak Console:

1. Open your project.
2. Go to API Keys.
3. Create a new key and copy it immediately.

Rooaak only shows the secret once.

API key format

Rooaak keys are generated in this format:

rk_<env>_<prefix>_<secret>

Example env values: live, test.

Send key on every /v1/* request

Authorization: Bearer <api_key>

Key types

• Project key: project_id is set, limited to one project.
• Admin key: project_id = null and must include admin:project scope.

Default scopes (when omitted on key creation)

• project:read
• project:agent
• project:api-keys
• project:message
• project:memory
• project:webhook
• project:event

Scope enforcement

Each endpoint validates required scope with requireScope(...). Missing scope returns 403 FORBIDDEN.

See /docs/api-reference/scopes for endpoint mapping.

Runtime auth is separate

/runtime/* does not use API keys. It uses an agent JWT (Authorization: Bearer <token>) validated against (agentId, userId).