Protected Rivo Business API requests should be made from your backend using API credentials issued by Rivo. Your app should never call protected Rivo Business endpoints directly from a browser or mobile app.

​
Required Headers

All API requests must include your API key in the Authorization header as a Bearer token. 
Authorization: Bearer YOUR_API_KEY

​
Where Requests Should Be Authenticated

Authenticate requests on your backend only. Do not put API secrets or authorization values in frontend code, mobile apps, analytics tools, public Postman workspaces, or logs.

​
Key Management

Businesses can create API credentials per environment. Key statuses:
StatusMeaning
activeThe key can authenticate API requests.
revokedThe key can no longer authenticate requests.