Authentication API

Every Core API request carries your user token in the Authorization header. The value is the token itself, for example u-your-token. Do not add Bearer. A Bearer value is not a user token and does not authenticate a Core API call.

You need a token before you can call the API. Creating one is covered on API keys.

Authorize a request

Send the header on every call. For example, to list your organisations:

Request

curl -X GET "https://api.requestrocket.com/api/clients" \
  -H "Authorization: u-your-token"

import axios from "axios";

const response = await axios.request({
  method: "GET",
  url: "https://api.requestrocket.com/api/clients",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "GET",
    "https://api.requestrocket.com/api/clients",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("GET", "https://api.requestrocket.com/api/clients", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "clients": [
    {
      "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "clientName": "Example",
      "clientMembers": [
        {
          "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
          "roles": ["owner", "admin"]
        }
      ]
    }
  ],
  "message": "Success"
}

{
  "message": "Unauthorized"
}

{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}

Returns the organisations this token can see, in clients, plus message. The organisation fields are documented on Organisation and team.

The token acts as the user who owns it. Requests reach the same organisations and resources that user can.

App guide

Do this in the app

Get started

Create the first proxy or MCP server

API keys

Keys for the Core API and Core MCP

Request lifecycle

The order of credentials, policy, and the target call