Authentication

Secure your RubikChat API requests with Bearer Token Authentication.

Introduction

All RubikChat API requests are secured using Bearer Token Authentication.

Before making any API request, you must generate an API Key from your RubikChat workspace and include it in the Authorization header of every request.

Note

All API endpoints require authentication. Requests without a valid API Key will be rejected with an authentication error.

Bearer Token Authentication

RubikChat uses Bearer Tokens to authenticate API requests.

Include your API Key in the Authorization header as shown below:

Header · text

Authorization: Bearer YOUR_API_KEY

Every authenticated request must include this header.

Generate an API Key

Sign in to your RubikChat Dashboard.
Navigate to Top Right Corner of Your Dashboard (Profile area) → Settings → API Access Token.
Click Generate Token.
Copy and securely store the generated API Access Token.

Warning

Never expose your API Access Token in frontend applications or public repositories. Always store it securely on your server.

Security Best Practices

Your API Key provides access to your RubikChat workspace and AI Agents. To keep your account secure, follow these best practices:

Never expose API Keys in frontend applications.
Never commit API Keys to public Git repositories.
Store API Keys securely using environment variables or a secrets manager.
Rotate API Keys periodically for improved security.
Immediately revoke and regenerate any API Key that may have been compromised.

Warning

Anyone with your API Key can perform actions on behalf of your workspace.

Example Authentication Request

The following example demonstrates how to authenticate while sending a chat request.

Request · bash

curl -X POST 'https://api-proxy-v1.rubikchat.com/api/v1/chat' \
-H 'Authorization: Bearer YOUR-API-ACCESS-TOKEN' \
-H 'Content-Type: application/json' \
-d '{
  "message":"Hello!"
}'

If authentication is successful, the API will process your request and return the appropriate response.

Invalid or Missing Authentication

If the API Key is missing, invalid, or expired, RubikChat returns an authentication error. Example response:

Error response · json

{
  "error": "Route not found"
}

HTTP Status Code · text

404 Not Found

Rate Limiting

To ensure platform stability and fair usage, RubikChat enforces rate limits on API requests.

Rate limits are applied per API Key and may also consider the originating IP address.

Note

The default rate limit depends on your subscription plan. Higher-tier plans may have increased limits.

Authentication Workflow

The authentication process follows these steps:

Generate an API Key from the RubikChat Profile → Account Settings.
Store the API Access Token securely on your server.
Include the API Access Token as a Bearer Token in every API request.
RubikChat validates the API Access Token before processing the request.
If the API Access Token is valid, the requested operation is executed; otherwise, an authentication error is returned.

Next: Agents