Get started

Authentication

Riscly's API uses bearer tokens, and every request is scoped to an organization. This page shows how to authenticate and how to keep a single helper for all your calls.

Request headers

Two headers identify and authorize each request:

Field	Type	Description
`Authorization`required	string	`Bearer <token>` — your session/access token. The dashboard obtains it from Supabase Auth; copy it from your account or sign-in session.
`x-org-id`required	string	The organization (workspace) the request acts within. Returned by the /me endpoint as activeOrg.id.
`Content-Type`	string	`application/json` for requests with a body (POST, PATCH, PUT).

Keep tokens secret

Tokens grant access to your code, scans and billing. Never embed them in client-side code or commit them to a repository — load them from environment variables or a secrets manager.

Find your org id

Call GET /api/me to confirm your token works and read your active organization, role and subscription:

curl https://api.riscly.com/api/me \
  -H "Authorization: Bearer $RISCLY_TOKEN"

A reusable helper

To avoid repeating headers, wrap fetch once. Every other example in these docs uses this riscly() helper:

const BASE = "https://api.riscly.com/api";

export function riscly(path, init = {}) {
  return fetch(BASE + path, {
    ...init,
    headers: {
      Authorization: `Bearer ${process.env.RISCLY_TOKEN}`,
      "x-org-id": process.env.RISCLY_ORG_ID,
      "Content-Type": "application/json",
      ...init.headers,
    },
  });
}

Errors

Errors return a JSON body with a message field and a standard HTTP status. A 401 means the token is missing or expired — re-authenticate. A 403 means your role or subscription does not permit the action.

{
  "statusCode": 401,
  "message": "Unauthorized"
}

PreviousQuickstart Next Connect a repository