Free Features · RKX API Studio 1.0.0
Public versus protected
A public GET endpoint can be read without a key. In Settings → Security, generate a key before enabling Require API Key on an endpoint. Free supports one shared key through X-RKX-API-Studio-Key. The header below reads a shell environment variable; set it privately before running the command.
- Open RKX API Studio → Settings → Security.
- Generate the shared key in Free and store it in your backend secrets.
- Edit the endpoint and enable Require API Key, then save.
- Request without the key and confirm access is denied.
- Request with X-RKX-API-Studio-Key from your backend and confirm the expected output.
curl -i \
-H "X-RKX-API-Studio-Key: $RKX_API_KEY" \
"https://example.com/wp-json/rkx-api-studio/v1/articles"Pro named keys and Bearer
Licensed Pro adds named keys and per-endpoint allowed-key selections. It accepts Authorization: Bearer and falls back to the RKX header when Bearer is absent. If both are supplied, Bearer takes precedence. Keys are endpoint credentials, not OAuth tokens, JWTs or WordPress user identities.
curl -i -H "Authorization: Bearer $RKX_API_KEY" \
"https://example.com/wp-json/rkx-api-studio/v1/articles"Respond to a compromised key
Regenerate or revoke the affected key in Security, then update the trusted clients using it. Test an old credential to confirm access is denied. Missing or invalid credentials return an authorization error. Protected responses use private, no-store cache headers; never publish a key in frontend code, query strings, tickets or screenshots.