Authentication

Every request to https://api.resia.ai uses a bearer token in the Authorization header:

Authorization: Bearer YOUR_RESIA_API_KEY

Resia accepts two kinds of bearer token:

What an API key can do

An API key can use every runtime endpoint: agents, calls, batches, chats, texts, workflows, phone numbers, knowledge bases, 10DLC, billing, rate limits, and request logs.

Some actions need a person who is signed in. An API key gets 403 on them:

• Create or rename your organization.
• Invite, list, or remove members.
• Create, list, or revoke API keys.
• Accept an invitation.

This keeps a leaked key from creating more keys or adding people to your organization.

Keep keys safe

• Store keys in a secret manager, not in source code.
• Use a key only on your server. Never send it to a browser or a mobile app.
• Create one key per service, and give each a clear name, so that you can revoke one without affecting the others.
• Resia shows each key once and stores only a fingerprint. If you lose a key, create a new one.
• Revocation is immediate and permanent.

Endpoints that need no token

• GET /health
• The API contract and docs: /openapi.json, /changelog, and /llms.txt

Errors