Authenticate with the RentFAX API

Every request to the RentFAX API must include a valid API key. The API uses key-based authentication — there are no session cookies or OAuth flows for server-to-server calls. You include your key in a request header, and the API validates it on each call.

Obtaining an API key

You can generate an API key in two ways:

Dashboard: Go to Settings → API Keys in your RentFAX account and click Create Key.
API: Send a POST request to /v1/keys authenticated with an existing key (or your dashboard session token).

Your API key is shown only once, immediately after creation. Copy and store it securely before closing the dialog — it cannot be retrieved again.

You can have up to 5 active keys per account at any time. To create a new key once you reach the limit, revoke an existing one first.

Passing your API key

You can authenticate requests using either of the following headers. Both are accepted by every endpoint.

Option 1: `x-api-key` header

x-api-key: rfx_live_your_key_here

Option 2: `Authorization: Bearer` header

Authorization: Bearer rfx_live_your_key_here

Both headers have identical behavior. Choose whichever fits your HTTP client or integration library best.

Code examples

curl https://api.rentfax.io/v1/renter/check?email=jane@example.com \
  -H "x-api-key: rfx_live_your_key_here"

curl https://api.rentfax.io/v1/renter/check?email=jane@example.com \
  -H "Authorization: Bearer rfx_live_your_key_here"

const response = await fetch(
  'https://api.rentfax.io/v1/renter/check?email=jane@example.com',
  {
    headers: {
      'x-api-key': process.env.RENTFAX_API_KEY,
    },
  }
);

const data = await response.json();
console.log(data);

import os
import requests

response = requests.get(
    'https://api.rentfax.io/v1/renter/check',
    params={'email': 'jane@example.com'},
    headers={'x-api-key': os.environ['RENTFAX_API_KEY']},
)

data = response.json()
print(data)

API key format

All RentFAX API keys begin with the prefix rfx_live_ followed by a 32-character alphanumeric string. For example:

rfx_live_A3bCdEfGhJkLmNpQrStUvWxYz234567

The API rejects any key that does not start with rfx_. If you receive an Invalid API key format error, check that you are not passing a dashboard session token or a truncated key value.

401 Unauthorized errors

A 401 response means the request could not be authenticated. The response body describes the specific reason.

Missing key
Invalid format
Revoked or not found

Cause: No x-api-key or Authorization header was sent.

{
  "ok": false,
  "error": "Missing API key.",
  "docs": "https://docs.rentfax.io/api"
}

Fix: Add the x-api-key header to your request.

Cause: The key value does not start with rfx_.

{
  "ok": false,
  "error": "Invalid API key format. Keys begin with rfx_"
}

Fix: Verify you are passing the full key, not a preview or truncated value. The dashboard shows only the first 12 characters of existing keys — use the value saved at creation time.

Cause: The key exists in your account but has been revoked, or the key value does not match any active key.

{
  "ok": false,
  "error": "API key not found or revoked."
}

Fix: Go to Settings → API Keys in the dashboard and confirm the key is active. Generate a new key if needed.

Rate limits

The API enforces per-key rate limits measured in requests per minute:

Plan	Limit
Standard	100 requests / minute
Enterprise	1,000 requests / minute

When you exceed the limit, the API returns a 429 status with a Retry-After: 60 header. Wait for the indicated number of seconds before retrying.

{
  "ok": false,
  "error": "Rate limit exceeded. 100 requests/minute on standard plan."
}

Security best practices

Never hardcode your API key directly in source code or commit it to version control. A leaked key grants full API access under your account.

Store keys in environment variables (e.g., RENTFAX_API_KEY).
Use separate keys for development, staging, and production environments.
Revoke any key you suspect has been exposed and generate a replacement immediately.
Treat your API keys with the same care as passwords.

Managing keys

To create, list, or revoke API keys:

Dashboard: Go to Settings → API Keys — see API keys for a step-by-step guide.
API: Use the /v1/keys endpoints — see the keys endpoint reference.

Overview

Renters

Reports & Incidents

Webhooks

Authenticate with the RentFAX API

Obtaining an API key

Passing your API key

Option 1: `x-api-key` header

Option 2: `Authorization: Bearer` header

Code examples

API key format

401 Unauthorized errors

Rate limits

Security best practices

Managing keys

​Obtaining an API key

​Passing your API key

​Option 1: x-api-key header

​Option 2: Authorization: Bearer header

​Code examples

​API key format

​401 Unauthorized errors

​Rate limits

​Security best practices

​Managing keys

Obtaining an API key

Passing your API key

Option 1: `x-api-key` header

Option 2: `Authorization: Bearer` header

Code examples

API key format

401 Unauthorized errors

Rate limits

Security best practices

Managing keys