Authentication

API keys

All requests to the RaaS Widgets Partner API require an API key in the X-API-Key header. Create and revoke keys in the Partner Portal.

Key format

Prefix	Environment	Example
`raas_sandbox_`	Sandbox	`raas_sandbox_a1b2c3d4e5f6…`
`raas_live_`	Production	`raas_live_a1b2c3d4e5f6…`

API keys are shown only once when created. Store them securely — you cannot retrieve the full key later.

Using your API key

curl -X GET https://raas-widgets-backend-sandbox.up.railway.app/partner/me \
  -H "X-API-Key: raas_sandbox_your_api_key_here"

const response = await fetch(
  'https://raas-widgets-backend-sandbox.up.railway.app/partner/me',
  {
    headers: { 'X-API-Key': process.env.RAAS_API_KEY },
  },
);

import os, requests

response = requests.get(
    'https://raas-widgets-backend-sandbox.up.railway.app/partner/me',
    headers={'X-API-Key': os.environ['RAAS_API_KEY']},
)

Managing keys

From the Partner Portal you can create, revoke, and monitor keys. Prefer separate keys per service so you can rotate without a full outage.

Never commit API keys to source control. Load them from a secret manager or environment variables.

Authentication errors

Missing API key

{
  "success": false,
  "error": {
    "code": "MISSING_API_KEY",
    "message": "X-API-Key header is required"
  }
}

Invalid API key

{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid or revoked API key"
  }
}

Webhook signatures

Outbound webhooks are signed with HMAC-SHA256. Verification uses these headers:

Header	Purpose
`X-RAAS-Signature`	HMAC signature
`X-RAAS-Timestamp`	Unix timestamp
`X-RAAS-Event`	Event name

See Webhook Security for verification examples.

Scope of this API

This documentation covers the Partner-accessible API only. Flow widgets authenticate to the backend with magic-link JWTs (Widget API), and Leap operators use the Superadmin API — those surfaces are not documented here.

Getting Started

Request API

Concepts

Integration

Flows

Webhooks

Operations

API keys

Key format

Using your API key

Managing keys

Authentication errors

Missing API key

Invalid API key

Webhook signatures

Scope of this API

Next steps

Quick Start

Create links

​API keys

​Key format

​Using your API key

​Managing keys

​Authentication errors

​Missing API key

​Invalid API key

​Webhook signatures

​Scope of this API

​Next steps

Quick Start

Create links

API keys

Key format

Using your API key

Managing keys

Authentication errors

Missing API key

Invalid API key

Webhook signatures

Scope of this API

Next steps