Skip to main content
Agents: the full documentation index is at /llms.txt.
Every request sends an API key as a bearer token:
Keys look like rvc_live_…. A key acts for one workspace, as the person who made it, with their role there.

​
Getting a key

Admins and Editors both make their own keys, unless the workspace’s admins turned Editors’ keys off. The workspace needs an active plan or credits. Keys expire after 30, 90 or 365 days. A workspace can have 5 active keys.

​
What a key can do

A key carries its creator’s permissions, checked again on every call: Another member’s project or search answers 404, as one in another workspace does. GET /v1/me returns acts_as: the person and their role. The role is read on every call. Make an Admin an Editor and their keys narrow at once; remove someone from the workspace (in the app, or in your identity provider) and every key and connected app they made is revoked. Searches a key launches spend the workspace’s credits, as the person could in the app, under the same caps and approvals.

​
Limits for members

Admins set these under Settings → Integrations → API, for every member’s keys and connected apps, and can override any of them for one member. Each takes effect on the next call. A search launched without max_credits reserves the member’s max per search, or what is left of their monthly budget. Editors see their own limits and this month’s use on the same page.
Revcenter Settings, Usage, API tab: credits, a create-key form, and a list of keys with created, last used and expiry dates

Settings → Integrations → API: create a key, see when each was last used, and revoke it.

​
Giving an agent access

Keep the key out of prompts, transcripts and config files:
  1. Browser login. The agent runs revcenter auth login --start, you open the link and approve, then it runs revcenter auth login --finish. The key goes straight to the credentials file; the agent never sees it.
  2. MCP. The MCP server reads the saved key, so your client config holds no key.
  3. Servers and CI. Put the key in a secret manager and expose it as REVCENTER_API_KEY.
Give each machine or system its own key, so you can revoke one without touching the others.

​
Revoking

Revoke a key under Settings → Integrations → API; it stops working immediately. Editors see and revoke their own keys; admins see every key in the workspace, with who made it, when, how (Settings, CLI, Claude, ChatGPT or another app), its scopes and when it was last used, and can revoke any of them. To rotate, create a new key, deploy it, then revoke the old one. Revcenter stores only a hash and can’t show a key again.

​
Browser login API

How revcenter auth login gets a key. Neither endpoint needs one. With a browser (OAuth authorization code with PKCE), as Claude Code and other CLIs sign in:
  1. Listen on http://127.0.0.1:<port>/callback and open https://app.revcenter.ai/oauth/authorize?client_id=revcenter-cli&response_type=code&redirect_uri=…&code_challenge=…&code_challenge_method=S256&state=….
  2. The person signs in, picks a workspace and authorizes. The browser returns to your callback with code and state (or error=access_denied).
  3. POST /v1/auth/token with grant_type: "authorization_code", the code, your code_verifier and the same redirect_uri. The answer is api_key (shown once), key and workspace. A code works once, for two minutes.
Without a browser (device flow), for SSH and agents’ shells:
  1. POST /v1/auth/device returns device_code (secret), user_code (e.g. BCDF-GHJK), verification_uri_complete, expires_in (600) and interval (5).
  2. Show the person the link and code. They authorize at https://app.revcenter.ai/oauth/device/<code>.
  3. Poll POST /v1/auth/token with {"device_code": "…"} every interval seconds:

​
Errors

Another workspace’s ids answer 404.