Authentication

Bearer Authentication

Send this header with every API request. A browser sign-in cookie does not replace the key. Each key acts only on integrations owned by its creator. It cannot list or change another account's webhooks.

Authorization: Bearer rpk_YOUR_API_KEY

Key Management

Create and revoke keys in Developer Console > API keys. Each account can have five active keys. API keys cannot create or revoke other keys. Delegated account access cannot create long-lived credentials for another account.

Republic stores a digest rather than the complete API key. If a key is lost or exposed, revoke it and create another. Revocation stops subsequent authenticated API calls; it does not pause existing subscriptions. Pause or remove destinations separately if needed.

Protect Your Credentials

Keep API keys and Discord webhook URLs in server-side environment variables or a secret manager. Avoid logging headers or webhook URLs. Responses never return stored webhook credentials. Rotate a Discord token by updating its URL; the webhook and thread IDs must stay the same.

Account restrictions can prevent creation, changes, or delivery. Read access and emergency pause, removal, and revocation remain available where supported.