Skip to main content

​
Getting an API key

  1. Open your dashboard → Account → Integration
  2. Click New API key, give it a name
  3. Copy the key — it is shown only once
  4. Under Access, select the point systems this key can interact with
A key with no point systems assigned has no access to any data or actions. Always scope keys to the minimum required point systems.

​
Scoping keys to point systems

Each API key is scoped to one or more point systems. Any request that references a pointSystemId not in that key’s scope will be rejected with a 403. This lets you issue separate keys per application or environment:

​
Permission level

In addition to its point-system scope, every API key carries a permission level, chosen when you create the key (Account → Integration). It is one of: Calling an endpoint the key isn’t permitted for returns 403. For example, a read-only key hitting /trigger, or a trigger-only key hitting /leaderboard.

​
Key format

API keys always start with rw_ followed by a 32-character hex string.
Keys are stored as a SHA-256 hash — Rewards never has access to the raw key after generation.

​
Error responses