# API keys and environments

Keep application authentication scoped to a project and separate from dashboard sessions.

Source: https://docs.ravenrelay.joshlab.site/api-keys

Agent index: https://docs.ravenrelay.joshlab.site/llms.txt
OpenAPI: https://docs.ravenrelay.joshlab.site/openapi.json

## Authenticate server requests

HTTP header

```
Authorization: Bearer rr_test_your_secret
```

Create keys in the project's API Keys screen. The secret is shown once and stored as a hash. Keep it out of browser bundles, source control and logs. Revoke a compromised key and create a replacement.

## Test and live environments

| Key | Project | Behavior |
| --- | --- | --- |
| rr_test_ | Development | Delivers through RavenRelay only to exact verified project domains, with delivery events and webhooks. |
| rr_live_ | Production | Sends through RavenRelay after operator activation and readiness checks. |

Production and development deliveries share one workspace monthly allowance. Both modes require an exact verified project domain with DKIM and MAIL FROM ready. New workspaces start with production sending disabled.

## Project scope and access

An API key can only access its project. Send-only keys can read messages created by that key; an email:read key can read its project's messages. Dashboard sessions manage domains, keys and webhooks separately and cannot submit email sends.

> Your application needs only a RavenRelay API key. Infrastructure credentials and encryption keys are managed by RavenRelay.