Authentication
API keys, the gateway boundary, and request signing basics
Every customer request authenticates with an API key presented in the
x-api-key header. Keys are verified at the edge before any route executes —
an unauthorized request never reaches the API.
Get an API key
Keys are issued per customer by platform operations. Each key is bound to your entitlement profile — what data you can see is decided by the signed entitlement bundle, not by the key alone.
Send it on every request
curl -H "x-api-key: $REALTY_API_KEY" \
"https://api.example.invalid/reso/odata/Property?\$top=5"Read the entitlement stamp
Every response is filtered by the signed entitlement resolved for the key. Account-resource and JSON responses expose the applied entitlement version; OData responses preserve the same authorization boundary while retaining the standard OData envelope.
Keys are secrets
Treat API keys like passwords: server-side only, rotate on suspicion, never embed in client-side code.