ReDesk AI › Authentication
Authentication Server-side calls use a secret key; anything running in a browser or on a crew's phone uses a short-lived OAuth token scoped to a single project. Keys are environment-specific and never cross between sandbox and live.
Secret keys Prefix Environment Use it from
sk_test_Sandbox Your servers, CI and local development
sk_live_Live Your production servers only
Send the key as a bearer token on every request:
curl https://api.redesk.ai/v1/projects \
-H "Authorization: Bearer sk_test_51Hx..." OAuth tokens for browsers and devices Exchange your secret key for a token scoped to one project and a list of permissions. Tokens expire after 15 minutes; mint a fresh one per session.
POST /v1/oauth/tokens
Mint a short-lived, scoped access token.
Parameter Description
projectbody · stringrequired
The project the token can act on. scopesbody · string[]required
Permissions, e.g. projects:read, sop_steps:write. ttl_secondsbody · integer
Lifetime, 60–900. Defaults to 900. curl -X POST https://api.redesk.ai/v1/oauth/tokens \
-H "Authorization: Bearer sk_test_..." \
-H "Content-Type: application/json" \
-d '{
"project": "prj_71Ka",
"scopes": [
"projects:read"
],
"ttl_seconds": 900
}' {
"object": "oauth_token",
"access_token": "rdk_at_9fK2...",
"expires_at": "2026-08-04T04:45:00Z",
"scopes": [
"projects:read"
]
} Rotating keys Rotate keys from the dashboard rather than in code. Revoked keys stop working within thirty seconds across every region .
Create the new key, deploy it, confirm traffic has moved in Settings → Developers → Logs, then revoke the old key. Both keys work in the meantime.
