Get startedAuthentication
Get started
Authentication
Bearer keys, presets, scopes, limits and rotation.
Pilotv1
Send the key as a bearer token over HTTPS. A key belongs to one business and one environment, and the business is never read from the request. A cookie never authenticates a developer route.
Header
Authorization: Bearer rvk_live_<key>Keys
- The owner makes keys in Settings, Developers, grouped by application. The secret is shown once; only a digest is stored.
rvk_live_keys read and change real data.rvk_test_keys work in the isolated test workspace.- A missing, malformed, unknown, expired or revoked key is one answer:
401 INVALID_CREDENTIAL, so nothing leaks. - Revoking applies to the next call. Rotating makes a new key with the same grants and ends the old one at once or after up to 24 hours, so you can roll it out without downtime.
- A key can be limited to some branches or programs. Anything outside its limits reads as
404.
Presets
| Preset | What it grants |
|---|---|
| Read-only | Can read permitted business data. Cannot change anything. |
| Full access | Every everyday permission, for your whole business. High-risk actions such as exporting or erasing customers and managing teams require a separate explicit choice. Use it only for a backend you fully control. |
| Choose permissions | Choose exactly which permissions this key gets. |
Scopes
Every route names the scope it needs. A key without it gets 403 INSUFFICIENT_SCOPE.
| Scope | Allows | In |
|---|---|---|
billing:pay | Start paying one of this business's invoices at the payment provider. Starting is not a confirmed payment: the provider's verified result is. Explicit owner choice only. | Ticked on purpose |
billing:read | Read this business's Revisit plan, subscription, entitlements, usage, invoices, coupons and payment status, and preview plan changes. Explicit owner choice only; never includes operator powers. | Ticked on purpose |
billing:write | Create invoices (activation, scan credit, SMS credit), redeem coupons, change plan, add-ons and renewal choices, and swap paused items after a downgrade, exactly as the owner can. Explicit owner choice only; never includes operator powers such as comping or recording a manual payment. | Ticked on purpose |
branches:read | Read permitted branches and their enrollment QRs. | Read-only, Full access |
branches:write | Create, edit, activate or close permitted branches under the existing plan and licence rules. | Full access |
business:delete | Schedule or cancel deletion of the whole business after the existing 14-day grace period. Explicit owner choice only; never part of a preset. | Ticked on purpose |
business:read | Read business settings and its enrollment QR. | Read-only, Full access |
business:write | Rename the business and change its category, counter script and average bill. Requires a whole-business key. | Full access |
customers:erase | Permanently erase a customer's name, phone, email and your ids for them. Cannot be undone. Never part of Read-only or Full access: tick it on purpose. | Ticked on purpose |
customers:export | Create CSV exports of customers and their memberships. Phone numbers are always masked and email is never included. Never part of Read-only or Full access: tick it on purpose. | Ticked on purpose |
customers:read | Search, count and read customers and their memberships. Phone numbers are always masked and email is never returned. | Read-only, Full access |
customers:write | Add and update customers by your own customer id, update their details, withdraw marketing consent, and enroll them in programs. Never gives marketing consent. | Full access |
displays:read | List the printable display designs and read, list and download the PNG or PDF displays generated for the business. A display holds only the shop's name, logo, words, reward and a join QR. | Read-only, Full access |
displays:write | Generate a printable display (Table tent, Counter stand, Door sticker or Wall poster) as a PNG or PDF for a permitted branch and card. Bounded, so it uses the shared request budget at a heavier weight. | Full access |
geo:read | Read permitted branch places and the business wallet radius. | Read-only, Full access |
geo:write | Change permitted branch places and, for whole-business keys, the wallet radius. | Full access |
loyalty:read | Read checkout reservations: what is held, what is confirmed, released or expired, and the available balance. | Read-only, Full access |
loyalty:write | Earn and redeem stamps and points for your customers from your own orders and services, once per order or service, and hold part of a balance during checkout. | Full access |
passes:read | Read issued gift cards, offers and generic passes: state and history, and a gift card's balance and currency. Never returns a PIN, a full number or a pass link. | Read-only, Full access |
passes:write | Issue gift cards, offers and generic passes, top up and spend gift cards in their own currency, redeem offers, record visits, and hand a pass to Apple or Google Wallet. | Full access |
programs:read | List and read loyalty programs. | Read-only, Full access |
programs:write | Create, change, move between branches, make chain-wide and delete Stamp and Points programs. | Full access |
push:read | Read who a push message would reach, ideas and numbers, saved templates, automatic alert settings and campaign status. Never returns a customer's name or phone. | Read-only, Full access |
push:write | Send and schedule wallet push campaigns, cancel a scheduled one, save templates and change automatic alert settings. Messages customers: the plan, opt-outs and daily limits apply. | Full access |
reports:read | Read the dashboard, analytics, activity feed and join-source figures the business sees in the app, for the same days. Customers appear only as ids and masked numbers: no names, no whole numbers, no devices or addresses. | Read-only, Full access |
shop-content:read | Read shop links, menus and their public photos within this key's branches. | Read-only, Full access |
shop-content:write | Edit shop links and menus and upload, caption, reorder or remove menu photos within this key's branches. | Full access |
sms:read | Read whether SMS is open for the business and its balance, preview who an SMS campaign would reach and what it would cost, and read campaigns and how each message went. Never returns a customer's name or phone. | Read-only, Full access |
sms:write | Create SMS campaigns that spend the business's SMS balance and text customers who agreed to offers by SMS, and cancel one before it goes out. Explicit delegation only: the first campaign still waits for an operator, and operators keep suspension and the kill switch. | Ticked on purpose |
support:read | Read when Revisit support viewed this business and whether changes were allowed. Never includes operator identities or free-text reasons. Explicit owner choice only. | Ticked on purpose |
team:read | Read business team members and invitation statuses within permitted branches. | Read-only, Full access |
team:write | Invite and manage non-owner team members. Explicit delegation only; cannot grant owner, developer keys or personal account access. | Ticked on purpose |
wallet:read | Read wallet designs, whether Apple and Google Wallet are available, and whether a member's pass was handed out. Never returns a pass link or card secret. | Read-only, Full access |
wallet:write | Create, change and delete wallet designs, upload design images, preview cards, and get a member's loyalty pass for Apple or Google Wallet. | Full access |