Authentication

API Keys

Every request to the Router9 API must include a valid API key. Keys are scoped to a specific agent plan and carry all associated quotas and permissions.

Key Format

sk-r9k-<48-character-hex-string>

Passing Your Key

Authorization header (recommended):

Authorization: Bearer sk-r9k-your-key-here

x-api-key header (alternative):

x-api-key: sk-r9k-your-key-here

Both methods are fully supported. The x-api-key header is useful for tools that don't support the Authorization: Bearer format.

Managing API Keys

View Your Key

Go to Agent → API Keys in the dashboard. For security, only the key hint (last 4 characters) is displayed after initial creation.

Regenerate a Key

Click Regenerate Key in the API Keys tab. This immediately invalidates the previous key and generates a new one.

The full key is displayed only once after regeneration. Copy it immediately.

Key Limits

Each agent plan has a single active API key at any time. Regenerating creates a new key and deactivates the previous one.

Error Responses

Missing Key

// 401 Unauthorized
{
  "error": "Missing authorization header"
}

Invalid Key

// 401 Unauthorized
{
  "error": "Invalid API key"
}

Expired Key

// 401 Unauthorized
{
  "error": "API key expired"
}

Security Best Practices

• Never commit API keys to version control
• Use environment variables to store keys
• Regenerate keys if you suspect they've been compromised
• Each agent should use its own isolated key — do not share keys across agents