Authentication
Rankings are public. Everything under /v1/reports needs an API key.
Send the key as a Bearer token
Section titled “Send the key as a Bearer token”Authorization: Bearer rmk_…curl https://api.recomention.com/v1/reports -H "Authorization: Bearer $RECOMENTION_API_KEY"A missing, malformed, unknown or revoked key gets 401 with a WWW-Authenticate: Bearer header and an error body.
Keys are shown once
Section titled “Keys are shown once”Create keys at recomention.com/account → Developers.
- Shown once. When you create a key it is displayed one time. Only a fingerprint of it is stored, so nobody can show it to you again. Lost one? Revoke it and create another.
- Recognisable. Every key starts with
rmk_, so a leaked key is easy to spot in a log or a secret scanner. The account page shows the first few characters of each key so you can tell them apart. - Up to 10 active keys per account.
- Revocable. A revoked key stops working within about a minute. The key stays listed, marked revoked.
A key reads only its own account
Section titled “A key reads only its own account”A report belonging to another account answers 404, exactly like a report that does not exist. You cannot tell the two apart, by design.
Starting reports needs a verified email
Section titled “Starting reports needs a verified email”The report link is emailed to the account’s address, so a start from an account whose email is not confirmed gets 403. Sign in once with the email link or a verified Google/Apple account.
Keeping keys safe
Section titled “Keeping keys safe”- One key per agent or machine, so you can revoke one without breaking the others. Each key also has its own rate limit.
- Keep keys in environment variables or a secret manager, never in a repository.
- In an MCP client config, the key goes in the server’s
env; see MCP server. - If a key might have leaked, revoke it first and investigate after.