Authentication

The RespawnHost API is authenticated with an API key. Generate keys from your account dashboard and assign each key only the scopes it needs.

API keys have the format rsp_ followed by 64 hex characters, e.g. rsp_a1b2c3…. Treat a key like a password — it grants access to everything its scopes cover.

Making Authenticated Requests

Send the key in the X-Api-Key header:

curl -X GET "https://respawnhost.com/api/v1/servers" \
  -H "X-Api-Key: rsp_YOUR_API_KEY"

Alternatively, you can send it as a Bearer token — both are accepted:

curl -X GET "https://respawnhost.com/api/v1/servers" \
  -H "Authorization: Bearer rsp_YOUR_API_KEY"

Using the TypeScript SDK

With the official @respawnhost/sdk, authentication is handled automatically:

import { RespawnHostClient } from '@respawnhost/sdk';

const client = new RespawnHostClient({
  apiKey: 'rsp_your-api-key',
  baseURL: 'https://respawnhost.com' // Optional, this is the default
});

We recommend storing your API key in an environment variable:

const client = new RespawnHostClient({
  apiKey: process.env.RESPAWNHOST_API_KEY!
});

Required Headers

API Key Scopes

Scopes are resource-level: a scope grants full access to that resource group. When creating a key, select only the resources you need.

Scope matching is prefix-tolerant: a finer scope string like servers:read still satisfies the servers requirement.

Error Responses

Security Best Practices

• Never commit API keys to version control
• Use environment variables to store keys (the SDK supports process.env.RESPAWNHOST_API_KEY)
• Create separate keys for different applications
• Use the minimum required scopes
• Rotate keys periodically