API keys
Create, label, rotate and revoke the keys your backend uses to call RideWiseCore.
An API key identifies your organisation to RideWiseCore. You can have as many active keys as you like. Each one gives full access to your tenant, so treat every key like a password.
Anatomy of a key
rwc_Q2x0eU9oTWJ3a1ZzR3pYcE5mZ2hKc0RqS2xtTm9QcVI
└┬─┘└─────────────────────┬─────────────────────┘
prefix random secret (256-bit)- Every tenant API key starts with
rwc_, so a pasted or leaked key is easy to spot. - RideWiseCore stores only a SHA-256 hash of keys you issue. Their plaintext is shown once, when the key is created, and can't be recovered.
- The exception is the Trial key created when you sign up: Show and Copy on Dashboard → API Keys reveal it again for as long as it isn't revoked. Only accounts created through sign-up have one. See Finding your Trial key.
- A key has an optional label, a created timestamp, and a revoked timestamp once you revoke it.
Creating a key
Keys are created in the dashboard. Your account must be active and either in its free trial or have a payment method on file. Once the trial has ended without a card, creating a key fails with 402, and while your account is suspended or cancelled it fails with 403. Listing and revoking keys always work.
Open Dashboard → API Keys.
Optionally type a label, for example production-backend, and click Issue key.
Copy the key from the dialog and store it in your secrets manager. Once you close the dialog, the key can't be shown again.
Revoking a key
Revoking takes effect immediately. Any REST request that uses the key gets 401 Invalid or revoked API key. Revoked keys stay in your key list, marked Revoked, so you keep an audit trail. A revoked key can't be re-enabled.
Click Revoke next to the key in Dashboard → API Keys.
Open socket connections are authenticated when they connect. After you revoke a key, reconnect every service that was using it with its replacement.
Rotating a key
Because you can have several active keys at once, you can rotate without downtime:
Issue a new key, labelled with the date, for example production-2026-09.
Deploy the new key to your backend and restart or reconnect its socket connection.
Verify that traffic is flowing with the new key, for example that matches are being created and agent updates are arriving.
Revoke the old key.
If a key leaks
- Revoke the leaked key straight away. Don't wait until a replacement is deployed. A short outage costs less than someone else dispatching rides on your account.
- Issue a new key and deploy it.
- Check Dashboard → Overview for unexpected match volume or active agents.
Your dashboard login is separate
Logging in to the dashboard doesn't use an API key, so revoking keys never logs you out of the dashboard. Changing your dashboard password doesn't affect your API keys either.