Authentication - Ralph Studio

Every request to Ralph Studio requires two things, a slug that identifies your app, and an API key that proves you’re authorized to use it.

Your slug

When you create an app, Ralph Studio generates a unique slug for it. The slug is a short hex string that becomes part of your RPC URL:

https://rpc.ralphstudio.xyz/{slug}/

The slug is not secret, it’s just an identifier. You can share it freely. What protects your endpoint is the API key.

Your API key

The API key goes in the Authorization header of every request:

curl https://rpc.ralphstudio.xyz/{slug}/infos/version \
  -H "Authorization: Bearer API_KEY"

API keys look like this:

rsk_live_a1b2c3d4e5f6...  (mainnet)
rsk_test_a1b2c3d4e5f6...  (testnet)

Security

Ralph Studio never stores your raw API key. When you create a key, the full value is shown exactly once. After that, only a preview is visible in the dashboard (e.g. rsk_live_013...f74c). If you lose your key, you can’t recover it, but you can roll it. Rolling generates a new secret for the same key record. Your slug and app settings stay the same, only the secret changes.

Managing keys

From the Apps page, expand any app to see its keys. From there you can:

Create additional keys (up to 10 per app)
Rename keys to track where they’re used
Enable or disable individual keys without deleting them
Roll a key to rotate its secret
Revoke a key permanently

Rate limits

Each key has its own rate limits:

Limit	Default
Requests per second	100
Requests per day	100,000

When you hit the per-second limit the request returns a 429 with a Retry-After: 1 header. When you hit the daily limit all requests return 429 until midnight UTC. You can see your current usage in the dashboard under Apps or on the Dashboard page.

Using keys in your app

For a frontend app, store the key in an environment variable and never commit it to version control:

RALPH_API_KEY=rsk_live_a1b2c3...
RALPH_SLUG=20623365b15d80f9

const response = await fetch(
  `https://rpc.ralphstudio.xyz/${process.env.RALPH_SLUG}/infos/version`,
  {
    headers: {
      Authorization: `Bearer ${process.env.RALPH_API_KEY}`,
    },
  },
);

For a backend app, the same pattern applies. Never expose your API key in client-side code.

​Your slug

​Your API key

​Security

​Managing keys

​Rate limits

​Using keys in your app