Authentication

Getting a key

Issue them in the dashboard: "API keys" → "New key". Give it a label and a set of rights and you get a plaintext rsk_<...> — shown once, with only a hash retained. Lost it: issue a new one and revoke the old one, in the same place.

We can hand you the first key along with dashboard access. After that it is your button: waiting on an operator to revoke a leaked key is not a dependency anyone wants during an incident.

Rotation: issue the new key, switch the integration over, revoke the old one. Both are live for exactly as long as your cutover needs.

Usage

Base address: https://logrus.space/api/v1/reseller. Every request needs the header:

Authorization: Bearer rsk_<key>

To check a key is alive:

GET /api/v1/reseller/me

200 OK
{
  "id": "0f2c...",
  "code": "your-brand",
  "name": "Your Brand",
  "status": "active",
  "revshare_pct": 30,
  "branding": { },
  "user_count": 0
}

Besides active, status can be suspended — write endpoints are closed then.

Scopes

A key is issued with a set of rights. Ask for the narrowest set that does the job:

• accounts:read — read the customer list and individual records.
• accounts:write — create customers.
• metrics:read — read aggregates.
• prices:read, prices:write — read and change your prices.
• payouts:read — read payout history.

A key missing the required scope gets a 403:

{
  "error": "api key lacks required scope: accounts:write",
  "code": "insufficient_scope",
  "details": { "required": "accounts:write" }
}

Rate limits

The limit is per key, not per partner: you run several integrations, and a dashboard stuck in a retry loop must not stop the bot that sells.

• Default 300 requests per minute per key.
• Roughly ten seconds' worth can go back to back (50 requests at 300/min); after that throughput settles at the limit.
• Over it → 429 with Retry-After in seconds:

429 Too Many Requests
Retry-After: 3

{
  "error": "rate limit exceeded for this api key",
  "code": "rate_limited",
  "details": { "retry_after_seconds": 3 }
}

Waiting exactly Retry-After is enough — you will not get a second 429 back to back. Each key's effective limit is shown in the dashboard; if your integration needs more, ask and we will raise it for that key.

Metrics are still not worth polling more than every few minutes: they are computed against the database on each call and do not change within a second.