Rebate Card X
StoresPartnersInvestorsHow it worksResources

Authentication

Use the authentication mode required by your operation.

Before making a request, distinguish public discovery, server-to-server order writes and first-party portal sessions. Each uses its own access rules; a developer API key does not authorize session-only operations.

Access modes

Find the access mode in the operation contract.

Choose the operation in the API reference first, then use its documented credential and scope. The table separates the callers so an integration does not mix a merchant API key with a browser session.

ModeCredentialCurrent use
PublicNoneAPI discovery, health, dependency status, OpenAPI and selected public claim or campaign resources.
API keyAuthorization: Bearer rbx_…Server-to-server order ingestion, refund recording and return recording.
SessionSecure host-only session cookie plus CSRF token for mutationsFirst-party merchant, cardholder and administration portals.

Check the x-authentication annotation on each operation in the Platform OpenAPI document. Do not substitute an API key for a session-only route.

API keys

Keep each API key tied to its tenant and environment.

Format
Bearer credentials begin with rbx_. The prefix is not a separate header name.
Ownership
Each key belongs to one approved tenant and one environment.
Current runtime scope
orders:write authorizes the three documented API-key operations. Do not rely on unused scope names as functional permissions.
Visibility
The full value is returned only at creation. Later listings expose a prefix, status, scopes and usage metadata.
Expiration
A key may have an expiry time. Expired and revoked keys fail authentication.

Authenticated requestHTTP

POST /api/v1/orders HTTP/1.1
Host: api.rebatecardx.com
Authorization: Bearer <RBX_API_KEY>
Content-Type: application/json
Idempotency-Key: <UNIQUE_KEY_16_TO_200_CHARACTERS>

Secret handling

Keep the key outside every client surface.

  • Load the key from a managed secret store at runtime.
  • Never embed it in browser JavaScript, mobile binaries, Shopify themes or downloadable configuration.
  • Never commit it to source control or paste it into tickets, chat messages, analytics or logs.
  • Redact the Authorization header at ingress, egress and observability boundaries.
  • Use separate staging and production secrets and rotate a key if exposure is suspected.
Not a browser API credential

CORS is restricted to official Rebate Card X origins. API keys are intended for approved server-to-server integrations.

Failures

Separate an invalid credential from a missing permission.

Use the error code to decide whether the credential needs attention or the requested operation is outside its permissions. The error guide explains the broader response and retry conventions.

StatusTypical codeMeaning
401API_KEY_REQUIREDThe operation requires a bearer key and none was accepted.
401INVALID_API_KEYThe key is invalid, revoked, expired or does not belong to an approved tenant.
403INSUFFICIENT_SCOPEThe key is valid but lacks the operation's required scope.
403TENANT_STATUS_RESTRICTEDThe tenant state does not permit the requested operation.