Authentication

The Rabisu Reseller API uses HTTP Basic Authentication. Each request sends an API Key (username) and an API Secret (password). No JWT or session is used — the API is fully stateless.

Credentials

When you become a reseller you receive two values:

Field	Example	Role
API Key	rsk_live_ab55mtkb7azdr1pyh5xs56whcab4pjv9	Username
API Secret	rsks_zfe4yk848aa737k3s1q1h3mmnd963jk6651fcc3	Password

Important: The API Secret is shown only once. Store it securely. If you lose it, you must rotate the secret or create a new key.

Request Example

The Basic Auth header is Authorization: Basic base64(api_key:api_secret). Most HTTP clients build it for you:

curl -u "rsk_live_ab55mtkb7azdr1pyh5xs56whcab4pjv9:rsks_zfe4yk848..." \
  https://api.rabisu.com/api/v1/auth/me

PHP (cURL) example:

$ch = curl_init('https://api.rabisu.com/api/v1/auth/me');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERPWD, $apiKey . ':' . $apiSecret);
$response = curl_exec($ch);

Failed Authentication

If credentials are missing or invalid, 401 Unauthorized is returned. For security, all failure cases return the same generic message (which field is wrong is never leaked):

{
  "success": false,
  "error": {
    "code": "unauthorized",
    "message": "Authentication failed."
  },
  "meta": { "trace_id": "...", "timestamp": "..." }
}

Per RFC 7235, 401 responses also include:

WWW-Authenticate: Basic realm="Rabisu Reseller API", charset="UTF-8"

Security Notes

• Never use the API Secret in client-side (browser) code. The API is designed for server-to-server calls only.
• Never log the Authorization header in plaintext.
• If a secret is leaked, rotate or revoke the key immediately.
• If an IP whitelist is configured, you can only access from allowed IPs.

Primary Endpoint: GET /auth/me

The simplest endpoint to verify your credentials. It returns the key owner, its permissions, and the auto_apply_credit flag:

{
  "success": true,
  "data": {
    "reseller_id": 42,
    "name": "Example Reseller",
    "permissions": ["*"],
    "auto_apply_credit": true,
    "last_used_ip": "203.0.113.5"
  },
  "meta": { "trace_id": "...", "timestamp": "..." }
}