Skip to main content

Documentation Index

Fetch the complete documentation index at: https://rendobar.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

Every Rendobar API request needs an API key in the Authorization header: 
curl https://api.rendobar.com/jobs \
  -H "Authorization: Bearer rb_live_YOUR_KEY"
Keys start with rb_live_ (production) or rb_test_ (test mode). Get one from app.rendobar.com → Settings → API keys. Test-mode jobs run end to end but don’t consume credits.

​
Three credential types

TypeWhere to use it
API key (rb_live_* / rb_test_*)REST API, MCP, CLI in CI
Session cookie (rb_session)Dashboard browser sessions only — set automatically when you sign in
OAuth 2.1 tokenMCP clients with native OAuth support, or the CLI’s rb login browser flow

​
Use a key

curl https://api.rendobar.com/jobs \
  -H "Authorization: Bearer rb_live_YOUR_KEY"

​
Manage keys

Keys are scoped to an organization, not a user. Each key has a name. There’s no per-org limit on the number of keys. 
# Create
curl -X POST https://api.rendobar.com/api-keys \
  -H "Authorization: Bearer rb_live_EXISTING_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "CI Pipeline" }'

# Revoke
curl -X DELETE https://api.rendobar.com/api-keys/KEY_ID \
  -H "Authorization: Bearer rb_live_YOUR_KEY"
Revoked keys return 401 UNAUTHORIZED immediately.

​
Auth context

Every authenticated request resolves to:
  • userId — the authenticated user (when via session or OAuth)
  • orgId — the active organization
  • plan — current plan; controls rate limits, allowed job types, balance
Used for rate limiting, plan enforcement, and credit checks on every request.

​
OAuth for MCP

MCP clients that speak OAuth 2.1 natively can register dynamically and run a PKCE flow against Rendobar’s authorization server. Tokens are scoped to the user’s organization. See MCP overview for setup. API keys are simpler and recommended for non-interactive integrations.

​
Errors

{ "error": { "code": "UNAUTHORIZED", "message": "Invalid or expired authentication" } }
HTTP 401. Other auth-adjacent errors live in Error codes.

​
See also