An API key is the credential that authenticates every RichAPI request. Create a key on the API Keys page of the RichAPI dashboard, then send the key in the x-api-key header. RichAPI shows the full key value one time at creation, and each workspace can hold 3 active keys at a time by default.
What is a RichAPI API key?
A RichAPI API key is a 40-character string of letters and digits. The key identifies a workspace, not a person. Every call that the key makes spends from the organization balance, and counts toward the monthly spend limit of the workspace that owns the key. RichAPI keeps a SHA-256 digest of the value and the first 8 characters of the value. RichAPI never keeps the full value, so a lost key cannot be recovered.
Where is the API Keys page?
Sidebar group: API Platform
Sidebar item: API Keys
URL:
/home/<workspace-slug>/api-keysPage title: API Keys
The page holds one security notice, titled API Key Security, and one card, titled API Keys. The card header shows a counter of active keys (e.g. 2 / 3) and the + Create New Key button. A workspace with no key shows the empty state No API keys yet.
Do I need a payment method before the first API key?
No. RichAPI asks for no payment method and no card before the first API key. Any member of a workspace can create the first key at once.
Your first workspace also receives 100 free trial credits. RichAPI grants those credits when a user creates a first workspace, and the grant needs no payment method.
Payment method required for a key: no.
Free trial credits: 100, worth $2.00 at 1 credit = $0.02.
When: at the creation of your first workspace, one time for each user, for all time.
A second workspace of the same user gets no further grant.
Add a payment method when you want to buy more credits.
How to create a RichAPI API key
Open the API Keys page (
/home/<workspace>/api-keys).Select + Create New Key.
In the Create API Key modal, type a descriptive name in the Name field (e.g.
Production Server). The field accepts 1 to 100 characters.
Select Create Key.
Read the API Key Created dialog.
Select the copy button beside the key value and paste the value into your secret manager.
Select the I have saved this key in a secure location checkbox.
Select Done.
CAUTION: Copy the key value before you close the dialog. RichAPI shows the full value one time and cannot recover it. The only remedy for a lost key is creating a new key.
RichAPI keeps the dialog open until you select the checkbox. The Done button stays disabled until then. After creation, a green toast notification confirms: "API key "" created successfully".
Why does RichAPI show an API key only once?
RichAPI never stores the key value. At creation RichAPI computes a SHA-256 digest of the value, keeps the digest and the first 8 characters, and returns the value to your browser one time. The digest authenticates a request. Nothing can rebuild the key from the digest.
Key length: 40 characters.
Character set: letters and digits.
Prefix that the dashboard shows: the first 8 characters, followed by
....What RichAPI stores: a SHA-256 digest and the prefix.
Can support recover the value? No.
The dialog states the same rule: "This is the only time your full API key will be displayed. Store it somewhere safe."
Where does the API key go in a request?
The key goes in the x-api-key header of every request to https://api.richapi.ai/api/v1. RichAPI reads no other header and no query parameter for authentication.
To test a new key, send a request to GET /usage. That endpoint returns your credit totals and charges no credits.
cURL
curl -X GET https://api.richapi.ai/api/v1/usage
-H "x-api-key: YOUR_API_KEY"
Python
import requests
response = requests.get(
"https://api.richapi.ai/api/v1/usage",
headers={"x-api-key": "YOUR_API_KEY"},
timeout=60,
)
response.raise_for_status()
print(response.json())
Node.js
const response = await fetch("https://api.richapi.ai/api/v1/usage", {
method: "GET",
headers: {
"x-api-key": "YOUR_API_KEY",
},
});
const data = await response.json();
console.log(data);
A 200 response confirms the key. A 401 response with the text Missing API key identity means that the key is absent, wrong, or revoked.
How to store a RichAPI API key safely
CAUTION: Treat the key value as a password. Anyone who holds the value can spend from your organization's credit balance.
Practice | What to do |
Storage | Put the value in a secret manager, or in an environment variable that your application reads at start. |
Source control | Keep the value out of your repository, your commit history, and your build logs. |
Sharing | Never paste the value into a chat, a ticket, a screenshot, or an email. |
Client code | Never put the value in a browser application or a mobile application. Call RichAPI from your server. |
Suspected exposure | Revoke the key at once, then create a new key. |
How many active API keys can a RichAPI workspace hold?
3 active keys by default. The card header shows a counter of your active keys, for example 1/3, 2/3 or 3/3. To raise the limit for a workspace, write to [email protected].
When the workspace reaches the limit of 3 active keys, RichAPI disables the + Create New Key button. To create another key when the limit is reached, revoke an active key first.
What does the API Keys page show for each key?
Column | What it shows |
Name | The descriptive name that you typed at creation. |
Key | The first 8 characters of the value, followed by |
Status |
|
Created | The creation date (e.g. |
Actions | 🗑 Revoke on an active key. Delete on a revoked key. |
A workspace with at least one revoked key also shows a Revoked Keys table under the active keys. A deleted key appears in neither table.
What is the difference between Revoke and Delete?
Revoke stops a key immediately. Delete removes a stopped key from the dashboard. RichAPI shows Delete on a revoked key only, so a key is always revoked before it is deleted.
Item | Revoke | Delete |
Where the button appears | On an active key ( | On a revoked key ( |
Effect on API requests | Every request with the key returns | The key already returned |
Effect on the page | The key moves to the Revoked Keys table | The key disappears from the page |
Effect on the active-key limit | Frees an active key slot (e.g., from | No change |
Usage and billing history | RichAPI keeps it | RichAPI keeps it |
Can a member undo it? | No | No |
How to revoke a RichAPI API key
CAUTION: A revoke takes effect at once. Every request with the revoked key returns 401, and no member can undo the revoke.
Open the API Keys page.
Find the key row in the table.
Select 🗑 Revoke.
Read the Revoke API Key dialog.
Select Revoke Key.
The dialog reads: "Are you sure you want to revoke the API key ""? Any applications using this key will lose access immediately. This action cannot be undone."
The key moves to the Revoked Keys table, freeing an active key slot in your workspace.
How to delete a revoked RichAPI API key
CAUTION: A delete removes the key row from the dashboard, and no member can undo the delete. A delete restores no access and frees no slot.
Open the API Keys page.
Find the key row in the Revoked Keys table.
Select Delete.
Read the Delete API Key dialog.
Select Delete Key.
The dialog reads: "Permanently delete the API key ""? This cannot be undone."
RichAPI keeps the usage and billing history of a deleted key. Your usage reports stay complete.
How to rotate a RichAPI API key with zero downtime
Because a workspace holds up to 3 active keys, you can rotate keys with zero downtime:
Open the API Keys page.
Make sure you have at least one free slot (e.g.,
1 / 3or2 / 3). If you already hold 3 keys, revoke an unused key first.Select + Create New Key.
Type a name (e.g.
Production Key - Q3) and click Create Key.Copy the new key and update your application, servers, or secret manager.
Send a test request to
GET /usagewith the new key to verify it returns200.Once traffic has successfully switched to the new key, return to the dashboard and select 🗑 Revoke on the old key.
A revoke also stops every AI client that a member authorized with that specific key through MCP. After rotation, authorize each MCP client again on the Connected Apps page if you rotated that key.
Who can create, revoke, or delete an API key?
Every member of the workspace. RichAPI applies no role check to any API key action.
Question | Answer |
Who can create a key? | Every member of the workspace. |
Who can revoke a key? | Every member of the workspace. |
Who can delete a revoked key? | Every member of the workspace. |
Is the Owner role required? | No. |
Who sees the key list? | Every member of the workspace. |
Which member created a key? | The page does not show it. |
Who pays for the calls of a key? | The organization balance, through the workspace that owns the key. |
A member of another workspace sees nothing and receives 403. To limit who can create or revoke a key, limit who joins the workspace.
How much does a RichAPI API key cost?
An API key costs no credits. RichAPI charges credits for successful API requests only. 1 credit costs $0.02 on the 1,000 and 5,000 credit packs, and less on larger packs.
Action | Credits |
Create a key | 0 |
Revoke a key | 0 |
Delete a revoked key | 0 |
Send a request to | 0 |
Send a request to an enrichment endpoint | The price of that endpoint |
The enrich_profile endpoint costs 1 credit per call. Your 100 trial credits therefore cover 100 profile enrichments.
Calls to | Credits | Cost |
25 | 25 | $0.50 |
100 | 100 | $2.00 |
1,000 | 1,000 | $20.00 |
How to fix a failed API key action
What you see | Cause | What to do |
The key value is gone after the dialog closes | RichAPI shows the full value one time. | Create a new key and copy the value before you close the dialog. |
Create Key stays disabled in the modal | The Name field is empty. | Type a name of 1 to 100 characters. |
Done stays disabled | The confirmation checkbox is not selected. | Select I have saved this key in a secure location. |
The dialog will not close | RichAPI blocks the close until you confirm the key is saved. | Copy the value, then select the confirmation checkbox. |
+ Create New Key is disabled | The workspace has reached its limit of 3 active keys ( | Revoke an unused active key first to free a slot. |
| The key is absent, wrong, or revoked. | Send the current key in the |
| The key resolves, but the workspace carries no access record. | Contact [email protected] with the key prefix. |
|
| Ask an organization owner to buy credits on the Plans & Billing page, or to raise the team's spend limit. |
An AI client fails after a revoke | The connected app was authorized with the revoked key. | Authorize the client again from the Connected Apps page. |
| You are not a member of this workspace. | Ask an Owner for an invitation. |
Delete is missing on a key | The key is still active. | Revoke the key first. Delete then appears in the Revoked Keys table. |
If a failure repeats, contact [email protected]. Name the workspace and the 8-character key prefix. Never send the full key value.
Frequently asked questions
Can I see a RichAPI API key again after I close the dialog?
No. RichAPI stores a SHA-256 digest of the key and the first 8 characters of the value, and never the value itself. Support cannot recover it. Create a new key and revoke the old one.
Do I need a credit card to create a RichAPI API key?
No. RichAPI requires no payment method before the first API key. Your first workspace receives 100 free trial credits, and a payment method is needed only to buy more credits.
How many active API keys can one RichAPI workspace hold?
Up to 3 active keys. Once a workspace has 3 active keys (3 / 3), the + Create New Key button disables until one of the keys is revoked.
How do I rotate a RichAPI API key with zero downtime?
With up to 3 active keys supported, create your new key while your old key is still running. Update your servers or applications, verify with GET /usage, and then revoke the old key.
Can a member without the Owner role create or revoke an API key?
Yes. Every member of the workspace can create, revoke, and delete API keys. RichAPI applies no role check to those actions.
Does a revoked RichAPI API key ever work again?
No. A revoke is final for a customer, and the dashboard offers no undo. Create a new key instead.
Does creating or revoking an API key cost credits?
No. Key creation, key revocation, and key deletion charge 0 credits. RichAPI charges credits for successful API requests only.
What else stops working when I revoke an API key?
Every integration that sends that key returns 401 at once. Every AI client that a member authorized with that specific key through MCP also fails, and a member must authorize each client again.
Related articles