> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ralphstudio.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How API keys and slugs work in Ralph Studio.

Every request to Ralph Studio requires two things, a slug that identifies your app, and an API key that proves you're authorized to use it.

## Your slug

When you create an app, Ralph Studio generates a unique slug for it. The slug is a short hex string that becomes part of your RPC URL:

```
https://rpc.ralphstudio.xyz/{slug}/
```

The slug is not secret, it's just an identifier. You can share it freely. What protects your endpoint is the API key.

## Your API key

The API key goes in the `Authorization` header of every request:

```bash theme={null}
curl https://rpc.ralphstudio.xyz/{slug}/infos/version \
  -H "Authorization: Bearer API_KEY"
```

API keys look like this:

```
rsk_live_a1b2c3d4e5f6...  (mainnet)
rsk_test_a1b2c3d4e5f6...  (testnet)
```

## Security

Ralph Studio never stores your raw API key. When you create a key, the full value is shown exactly once. After that, only a preview is visible in the dashboard (e.g. `rsk_live_013...f74c`).

If you lose your key, you can't recover it, but you can roll it. Rolling generates a new secret for the same key record. Your slug and app settings stay the same, only the secret changes.

## Managing keys

From the Apps page, expand any app to see its keys. From there you can:

* Create additional keys (up to 10 per app)
* Rename keys to track where they're used
* Enable or disable individual keys without deleting them
* Roll a key to rotate its secret
* Revoke a key permanently

## Rate limits

Each key has its own rate limits:

| Limit               | Default |
| ------------------- | ------- |
| Requests per second | 100     |
| Requests per day    | 100,000 |

When you hit the per-second limit the request returns a `429` with a `Retry-After: 1` header. When you hit the daily limit all requests return `429` until midnight UTC.

You can see your current usage in the dashboard under **Apps** or on the **Dashboard** page.

## Using keys in your app

For a frontend app, store the key in an environment variable and never commit it to version control:

```bash theme={null}
RALPH_API_KEY=rsk_live_a1b2c3...
RALPH_SLUG=20623365b15d80f9
```

```javascript theme={null}
const response = await fetch(
  `https://rpc.ralphstudio.xyz/${process.env.RALPH_SLUG}/infos/version`,
  {
    headers: {
      Authorization: `Bearer ${process.env.RALPH_API_KEY}`,
    },
  },
);
```

For a backend app, the same pattern applies. Never expose your API key in client-side code.