Authentication

Creating a key

Keys are created in Settings, under Developer, and start with rivo_live_. The full key is shown exactly once at creation; we store only a hash, so a lost key cannot be recovered, only replaced. You can hold up to 10 active keys, which is enough for one per client or environment.

Revoking a key

Revoke from the same Settings page. Revocation is immediate and permanent: revoked keys stay listed for your records but never authenticate again. There is no way to un-revoke, so treat a leaked key as gone and mint a new one.

Key management stays in the app

Keys cannot create, list or revoke other keys. Management requires a signed-in browser session, so a leaked key is contained: it can read data and manage strategies, but it cannot mint itself a replacement or lock you out.

Auth errors

• 401: the key is missing, malformed or revoked. Send it as Authorization: Bearer rivo_live_....
• 403: the key is valid but the account behind it has no active subscription. Fix the subscription and the key starts working again; no need to re-create it.

The full error catalogue is on the Errors page.