Docs / Authentication
Authentication
Three surfaces, three auth models: the demo tier needs no credential at all, the Partner API uses a key issued by RapidEye, and platform connectors are enabled per account.
The demo tier: no key
Everything under /demo is anonymous by design. A submission carries an email address and accept_terms in its body; the response returns a request_id and a poll_token, and only that pair reads the result back. No signup, no bearer token, no approval step.
curl -X POST https://api.rapideyeinspections.com/demo/inspections \
-H "content-type: application/json" \
-d '{"email": "you@company.com", "accept_terms": true, "photos": [ ... ]}'
The Partner API: a key issued by RapidEye
Production integrations under /v1 authenticate with a bearer partner key. Partner keys are not self-serve: they are issued by RapidEye when a partnership is set up, which starts with a short call. An agent can also submit the request programmatically with POST /demo/request-access, which returns the booking link to hand to its human.
Authorization: Bearer <partner key>
Treat the key as a secret. Keep it in an environment variable, never in client-side code or a public repository.
Connectors: enabled per account
Platform connectors under /connectors/{platform}/ are provisioned per account rather than by self-signup, because most platforms control access to their data at the source. A call to a connector that is not enabled for your account does not fail blind: it answers with the reason, the platform's status, and the booking link that turns it on.
curl https://api.rapideyeinspections.com/connectors/guesty/reservations
# -> 403 connector_not_enabled, with next_steps.book_a_call_url
Once a connector is enabled, the connection lives on your account rather than in a config file, which is the property that matters for agents: a future session, with a different model and no memory of this one, inherits working access on day one.
How credentials are stored
Platform credentials attached to an enabled connector are sealed before they are written, and decrypted only in memory to sign an outbound request. They are never returned by any endpoint.
Auth for agents
The handoff that works: the agent evaluates on /demo with no human in the loop, and when it hits a gated connector or wants production access, it surfaces the booking link the API just handed it. Every gated answer names the cause and carries the next step, so the agent never has to guess what to ask its human for.
