API keys
Each API key authenticates requests to the Rewards API. Keys are prefixed withrw_ and stored as a one-way hash — the raw key is shown only once at creation time.
Creating a key
- Dashboard → Account → Integration → New API key
- Give the key a descriptive name (e.g.
Production Oniria,Staging) - Choose a permission level (see below)
- Copy the key immediately — it cannot be retrieved after closing the dialog
- Under Access, select the point systems this key can interact with
Permission level
Every key is created with one of three permission levels, controlling which endpoints it can call:
A key calling an endpoint outside its permission gets a
403 (e.g. This API key does not have read permissions). Pick the narrowest level that covers what the integration needs: a server that only awards points should use a trigger key; a dashboard or widget that only displays data should use a read key.
Scoping keys
The Access dropdown controls which point systems a key can read and write.- A key with no point systems selected has no access to any data or actions
- Scope each key to the minimum required systems
- Create separate keys for production, staging, and read-only integrations
Revoking a key
Click Delete next to a key to revoke it immediately. Any requests using that key will return401.
Finding your Point System ID
Your Point System ID is required for all API calls. You can find it in: Settings → General — shown as both a short identifier (4 characters) and the full UUID, each with a copy button. Use the full UUID in API calls.Security recommendations
- Use separate keys per environment (production / staging / local)
- Rotate keys periodically or immediately if you suspect exposure
- Scope keys to only the point systems they need access to