Authentication
How API keys work, what they are scoped to, and how they fail.
Every request except GET /health needs an API key, sent as a bearer token:
Authorization: Bearer rc_live_YOUR_KEYThere is no other authentication scheme. Query-string keys, cookies and the
X-API-Key header are not accepted on the customer API.
Creating and revoking keys
Keys are managed on the Usage (API & Nutzung) page. A key is displayed once, at creation. Losing it means revoking it and creating another.
Revocation takes effect immediately, on the next request.
What a key is scoped to
A key belongs to your account, not to a project or an environment. Every key you hold reads and writes the same lists and the same monitors, and draws on the same credit balance. Use separate names to tell them apart in the usage breakdown; do not expect them to be isolated from one another.
Limits are shared across all of your keys
Besides each key's own monthly allowance, the same allowance is enforced across your account. Creating a second key does not give you a second allowance — see Rate limits.
Checking a key works
GET /health needs no key and tells you the API is reachable. To check the key itself,
use the cheapest authenticated call:
curl -sS -o /dev/null -w '%{http_code}\n' \
"https://api.registercheck.de/v1/search/suggestions?name=test&limit=1" \
-H "Authorization: Bearer $REGISTERCHECK_API_KEY"200 means the key is good. For anything else, see below.
Authentication failures
| Status | Body | What it means |
|---|---|---|
400 | Authorization header missing or invalid | No Authorization header, or it does not start with Bearer . |
401 | UNAUTHORIZED | The key is wrong, revoked, disabled or expired. |
402 | INSUFFICIENT_CREDITS | The key is valid; the account has no credits left for this call. |
429 | RATE_LIMITED | The key is valid; it or your account has used its request allowance. Wait for Retry-After. |
503 | SERVICE_UNAVAILABLE | Keys cannot be checked right now; your key was not rejected. Retry after Retry-After; do not rotate it. |
Keeping keys safe
- Keys carry the full permissions of your account, including deleting lists and monitors. Treat one as a password.
- Never ship a key in browser code. Every call in these docs is a server-side call.
- Rotate by creating the new key, deploying it, then revoking the old one — in that order.