Get an API key & authenticate

Create an API key

1. 1Log into the merchant dashboard, go to Developers → API Keys.
2. 2Click "Create key" and check the scopes this key needs.
3. 3The full secret (rbp_test_...) is shown exactly once — copy it immediately into a secret manager. After that, only the prefix is ever shown again.

Sending the key with a request

curl -sS "$BASE/api/Product" \
  -H "Authorization: Bearer $API_KEY"

Signed-in APIs: JWT + refresh token

ReBate Pay's own platform console (Admin*), merchant console (Merchant*) and consumer wallet (Member*) APIs don't use API keys — you sign in first and get tokens. Use the same flow when your app acts on behalf of a signed-in person.

curl -sS -X POST "$BASE/api/MerchantAuth/Login" -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"…","accountType":"Business"}'

• accessToken is a JWT that expires after 15 minutes (expiresIn seconds); send it as Authorization: Bearer on every request.
• When it expires the API returns 401 TOKEN_EXPIRED — call the matching */Refresh with your refreshToken for a new pair. Refresh tokens rotate on every refresh and the old one stops working at once; using the same refresh token twice returns 401 INVALID_REFRESH_TOKEN, so sign in again.
• Signing out revokes the refresh token; old tokens then get 401.
• GET /api/Auth/Identity returns who the current token belongs to (userType is Admin, Merchant or Member).
• A token of the wrong kind (e.g. a merchant token on Admin*) gets 403 WRONG_TOKEN_TYPE; API keys can't call signed-in APIs and JWTs can't call the developer API.
• Treat the refresh token like a password: keep it in secure storage (e.g. the app's secure store), never in URLs or logs.

Common scopes

A key only has the scopes you checked; write implies read. Grant only what you actually need. Full list at API Keys & Security.