Authentication

Auth: Secret API key (rk_sk_)

rokochat uses four key types across three integration surfaces. Never put rk_is_, rk_sk_, or rk_whsec_ in browser code. The site public key (rk_pk_) is not a secret — it only routes widget traffic.

rk_pk_ — Site public key. Browser only. Not secret.
rk_is_ — Identity secret. Server only. HMAC user_hash.
rk_sk_ — Secret API key. Server only. REST auth.
rk_whsec_ — Webhook signing secret. Server only. Verify inbound events.

Header parameters

Name	Type	Description
`Authorization`required	`string`	Bearer rk_sk_… for REST API requests
`X-Site-Public-Key`required	`string`	rk_pk_… for widget HTTP requests (or query param key)
`Origin`required	`string`	Must match a domain registered to the site (widget requests)

Responses

401Missing or invalid credentials

{
  "error": {
    "type": "authentication_error",
    "code": "authentication_error",
    "message": "Invalid API key"
  }
}