API keys and credits
The API & credits section of My Account is where you create the keys that authenticate calls to the RotorLab HTTP API under /api/v1, watch your daily usage, and buy API credits. The same key also authenticates the cloud relay agent for live telemetry: the account behind the key is the channel, and there is no separate credential to manage.
Open My Account, then API & credits, at https://rotorlab.app/account#api.
Creating a key#
Keys are created on demand, never automatically. Issue a separate named key for each integration, so that revoking a compromised key does not affect the others.
- Type a label in the "What will use this key?" field (up to 60 characters).
- Press Create API key (or Create another key if you already have one).
- Copy the key immediately. It is displayed once, at creation, and never again: only its SHA-256 hash is stored on the server.
Keys start with rl_. The list of your active keys shows each key's label, its identifying prefix (rl_ plus the first characters), when it was created, and when it was last used, so you can tell which credential has gone quiet. An account can hold up to 25 active keys.
Call the API with a bearer header (an X-API-Key header is also accepted):
curl -H "Authorization: Bearer rl_your_key" https://rotorlab.app/api/v1/versionThe base URL and header format are also shown on the card, with a link to the developer documentation. See API quickstart.
Revoking keys#
- Revoke next to a key retires that one credential. Anything still using it stops working immediately; your other keys are unaffected.
- Revoke all keys is the panic button: it revokes every key on the account at once.
Keys are independent of your browser sessions, so changing your password or signing out does not affect them.
The daily quota and credits#
Every metered API request is accounted the same way:
- Your daily quota is spent first. The limit comes from your organization's plan and resets at 00:00 UTC.
- Once the quota is exhausted, each request draws one credit from your balance. 1 credit equals 1 API call.
- When both are gone, the API returns
429with aRetry-Afterheader giving the seconds until the quota resets at UTC midnight.
Each metered response carries three headers so your client can track its own budget:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Your daily request limit |
X-RateLimit-Remaining | Requests left in today's quota |
X-RateLimit-Credits | Credits remaining in your balance |
The version and usage endpoints are free and do not spend quota or credits. A missing or invalid key returns 401.
The usage metrics on the card show requests today against your limit, requests remaining, and the credit balance.
Credits are shared by your organization#
The credit balance belongs to your organization, not to the person who bought it. Everyone in the organization draws on the one balance; each person's daily quota is their own. This means a finance office can buy credits once, and the balance survives any individual member leaving.
Organization administrators see the shared balance even when they hold no key themselves, along with a per-member breakdown: each member's calls today, calls over the last 30 days, and last call time, so whoever pays the bill can see where the balance went. An account with no organization keeps its own balance.
Buying credit packs#
When credit packs are on sale, the Buy credits card lists each pack with its credit amount and price. Press a pack to start the purchase:
- Checkout is hosted by the payment provider; the credits are granted automatically when the payment is confirmed.
Credits are spent only after the daily quota is used up, so buying a pack is a buffer, not a replacement for a plan with a higher daily limit.
The same key drives the cloud relay#
The cloud relay agent that streams live telemetry to RotorLab authenticates with this same API key. Mint a dedicated key labelled for the relay so it can be revoked on its own. See Cloud relay.