Authentication

API keys

Every request is authenticated with the Api-Key header.

curl -s https://sandbox.rasto.co/api/customers -H "Api-Key: sk_test_..."

You create, rotate, and revoke keys on the dashboard's API keys page, separately for sandbox and live. A key's secret is shown once, when it is created. We store only a hash, so a lost key is replaced rather than recovered. Rotating a key issues a replacement and keeps the old one valid for a grace window you choose (24 hours by default, at most 168), so you can deploy the new key before the old one stops working. Creation, rotation, and revocation are audit logged.

Account-level actions, such as managing API keys and registering wallet public keys, are not part of the /api/* surface and cannot be performed with an API key. A leaked API key therefore cannot alter its own access or replace your wallet identity.

Scopes

Keys are scoped full or read_only. A read-only key can call every GET and no mutation, and a mutation attempt returns 403 read_only_key.

Use read_only keys anywhere you do not need mutations. The call to design around is PATCH /api/virtual_accounts/{virtual_account_id}: whoever can repoint a destination controls where all future deposits are delivered.

Why a valid key can be refused

Authentication also enforces your account's standing:

• A suspended account is refused on every request with 403 partner_suspended.
• Live keys are refused until onboarding is complete. In order, live calls return 403 partner_terms_required until your executed Partner Terms are on record, 403 partner_kyb_required until your own business verification is approved, and 403 partner_wallet_keys_required until your live wallet keys are registered and activated. Sandbox keys are never gated on onboarding.

Rasto staff review your organization's KYB by hand, which can take a few business days, and its approval opens live access. While it is in review its details cannot be changed, and a decline is final: contact us to discuss it. See Going Live.

For every authentication and access code with its retry class, see Errors.

Transport and limits

• HTTPS only.
• Rate limited per API key once that key has authenticated, and per client IP otherwise: 25 requests per second sustained, with a burst allowance of 100. Exceeding it returns 429 rate_limited with a Retry-After header.
• Rate limiting happens before idempotency, so a 429 is never stored as a replayable response.
• Every response carries a request-id header, echoed inside error envelopes as request_id. Log it, and quote it when contacting support.