> This page is for TRF Agent.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://revenue-docs.creliohealth.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://revenue-docs.creliohealth.com/_mcp/server.

# API keys

API keys authenticate requests to the public Revenue Guard API. Keys are organization-owned, bound to a single environment, and scoped to the exact actions they may perform.

## Authenticating

Send your key in the `X-API-Key` header on every public request:

```bash
curl https://public-rg-api.crelio.solutions/public/v1/payers \
  -H "X-API-Key: $REVENUE_GUARD_API_KEY"
```

## Scopes

A key is granted one or more `resource:action` scopes. A request is rejected unless the key carries the scope the endpoint requires:

| Scope          | Grants                                                      |
| -------------- | ----------------------------------------------------------- |
| `order:create` | Submit orders for classification.                           |
| `payer:read`   | List payer categories, list payers, and read a payer by ID. |

Grant only the scopes an integration needs. A key cannot manage other keys — key management is a dashboard-only, session-authenticated action.

## Environment binding

Every key is tied to one environment at creation and its prefix makes that explicit:

* `rg_test_` — sandbox keys, sandbox data only.
* `rg_live_` — live keys, live data only.

A key can never reach the other environment. See [Environments](/environments) for the full model.

## Managing keys in the dashboard

The **API Keys** page shows the keys for the active environment as a set of cards with each key's status (active, disabled, or expired), mode, scopes, last-used time, request count, and expiry.

![API Keys page](/_fern-files/creliohealth.docs.buildwithfern.com/cc596961d248350345ea3e34e87ce6bd102273961e48fb2f5e971924e7432be1/docs/assets/screenshots/placeholder.svg)

#### Create a key

Give the key a name, choose at least one scope, and optionally set an expiry (presets of 30, 60, 90, or 365 days, or never). The environment matches the mode you have selected.

#### Copy the secret once

The plaintext key is shown exactly once at creation. Store it securely — every later view shows only a masked preview such as `rg_live_abcd••••••••`.

#### Rotate, disable, or revoke

Rename a key or change its scopes at any time. Disable a key to block it without deleting it, or revoke it to remove it permanently.

> **Note**
>
> The plaintext value of an API key is returned only at creation and is never retrievable afterward. If a key is lost or exposed, revoke it and create a new one.

## Request logs

Every request made with a key is logged. The **API Keys** page includes a request log you can filter by key, HTTP method, status bucket (success, client error, server error), date range, and free-text search across trace ID, order ID, endpoint, or key name.

![API request logs](/_fern-files/_img/f0407f9f39fa68cac5dd8ae8c8f9db3697c2b22aa47edcac38e47b70e6b1225e.webp)

Open a log entry to inspect the full request and response — masked headers, request and response bodies, the resulting order ID, trace ID, latency, and status. This is the fastest way to debug an integration issue end to end.