Docs / Authentication
Authentication
One bearer token for every platform. Here is how keys work, how platform credentials attach to them, and how they are stored.
Your developer key
Every request authenticates with a RapidEye developer key, prefixed re_, sent as a bearer token:
Authorization: Bearer re_...
Keys are free and issued instantly from an email address, either at the signup page or by calling POST /v1/signup. There is no approval step for the key itself; what varies per platform is whether that platform's bridge is enabled on it.
Treat the key as a secret. It carries access to every platform account you have connected. Keep it in an environment variable, never in client-side code or a public repository.
Connecting a platform
A key on its own reaches nothing. You connect each platform account once, by posting that platform's own credentials:
curl -X POST https://api.rapideyeinspections.com/v1/connections/{platform} \
-H "Authorization: Bearer re_..." \
-H "content-type: application/json" \
-d '{ ...platform credentials... }'
| Platform | Fields | Where they come from |
|---|---|---|
hostaway | accountId, clientSecret | Hostaway dashboard, Settings then Hostaway API. We exchange these for their OAuth bearer and refresh it for you. |
ownerrez | email, token | Personal access token (pt_) from Settings, Advanced Tools, Developer/API Settings. Shown once. |
pricelabs | apiKey | Account Settings, then API Details, then Get PriceLabs API Key. |
Connections live on the key rather than in a config file, which is the property that matters for agents: a future session, with a different model and no memory of this one, inherits working access on day one.
How credentials are stored
Platform credentials are sealed with AES-GCM before they are written, and decrypted only in memory to sign an outbound request. They are never returned by any endpoint: GET /v1/me lists which platforms are connected, never the values.
Auth for agents
The handoff that works: the agent calls POST /v1/signup or sends its human to the signup page, the human returns one key, and the agent uses it for everything after. One credential, one header, every platform. If a call returns 403 early_access, the response body carries a booking link the agent can surface to its human, and the same key starts working on that platform once provisioned.

