Authentication

Every request is authenticated with an API key sent as a bearer token. Keys are created in your RoutePath.to account, and a key acts as that account, limited to the scopes you gave it.

Authorization: Bearer rpto_YOUR_API_KEY

The API base URL is:

https://www.routepath.to/links-api

Creating a key

Sign up or sign in at RoutePath.to, then create a key in Settings. Choose its scopes and, optionally, an expiry. The full key is shown only once and only a hash is stored, so if you lose it, create a new one.

Scopes

• links.read — list and read links, tags, and export.
• links.write — create, update and delete links and tags.
• analytics.read — read link and account analytics.

A request needing a scope your key doesn't have is answered with 403.

Revoking a key

Delete the key in Settings. It stops working immediately and requests with it return 401.

What a key can't do

Account settings (creating keys, webhooks and domains) can only be changed from the dashboard, so a leaked key can't mint more keys or redirect your webhooks. Those requests with an API key return 403.

Keep keys secret

• Call the API from your server, never from browser code.
• Store keys in environment variables or a secrets manager, not in source control.
• Use a separate key per application so you can revoke one without affecting the others.

Your plan sets how many keys you can have and how many requests you can make each month, see limits & errors.