Developer documentation
Authentication
Use API keys for server integrations and rotating access tokens for dashboard sessions.
API key authentication
Server-to-server integrations should use an rcn_test_ or rcn_live_ key in the Authorization header. Never put an API key in a URL, browser bundle, mobile application, source repository or support message.
HTTP
Authorization: Bearer rcn_test_…User sessions
POST /auth/login accepts email and password and returns a short-lived access token plus a refresh token. Access tokens authenticate dashboard requests. Refresh tokens are single-use: refreshing revokes the old record and issues a new pair.
Shell
curl "https://api.redmontcredit.com/api/v1/auth/login" \
-H "Content-Type: application/json" \
-d '{"email":"operator@example.com","password":"a-long-password"}'Refresh
curl "https://api.redmontcredit.com/api/v1/auth/refresh" \
-H "Content-Type: application/json" \
-d '{"refresh_token":"REFRESH_TOKEN"}'Institution roles
| Role | Intended use |
|---|---|
| OWNER | Full institution control |
| ADMIN | Users, keys, reporting, reports, disputes, audit and webhooks |
| UNDERWRITER | Credit queries and reports |
| ANALYST | Credit queries, reports and audit |
| DEVELOPER | API integration and reporting operations |
| VIEWER | Read-only credit and report access |
RCN administrators
Platform administrators are separate from institution roles. Administrative tokens can access cross-network admin routes and must be restricted to authorised RCN operators.
Troubleshooting access
- 401 INVALID_API_KEY: verify the Bearer header, environment, expiry and revocation state.
- 403 INSUFFICIENT_SCOPE: compare the endpoint permission with the key scopes or user role.
- 403 for a valid key: confirm institution status is ACTIVE and the calling IP matches allowed_ips.
- Keep test and live credentials in separate secret stores and deployment environments.