Authentication - Reap Business Account API

Send your API key in the x-api-key header on every request:

curl "https://api.global.direct.reap.global/2026-07-13/team-members" \
  -H "x-api-key: YOUR_API_KEY"

Keep keys server-side. A key in a browser or mobile app is a leaked key; revoke it and rotate. Store keys in a secrets manager, and keep the IP allowlist on.

Scopes

Each endpoint requires a scope; it’s listed at the top of the endpoint’s page. A key’s scopes can be edited at any time after the key is created: an admin updates it in the dashboard. New scopes are never added to existing keys automatically.

Scope	Endpoints it unlocks
`team_members:read`	`GET /team-members`
`cards:read`	`GET /cards*`, `GET /cards/categories`, `GET /cards/transaction-categories`
`cards:write`	`POST /cards`, `PUT /cards/{cardId}`, `DELETE /cards/{cardId}`, freeze/unfreeze, restriction
`cards:read_vault`	`POST /cards/{cardId}/reveal`
`spend_controls:write`	`PUT /cards/{cardId}/spend-control`
`card_account_balances:read`	`GET /cards/balances`
`card_activities:read`	`GET /cards/activities`
`treasury_funding:read`	`GET /treasury/funding-options`, `GET /treasury/funding-instructions`
`treasury_funding:write`	`POST /treasury/bank-transfer-confirmations`
`treasury_transactions:read`	`GET /treasury/transactions`

GET /health needs no scope; any valid key works. When the MCP server launches (coming soon), it uses the same API keys and scopes, and the key’s IP allowlist applies to MCP calls too, from wherever the tool runs.

Auth errors

Response	Meaning
`401 AUTH_CREDENTIAL_MISSING`	No `x-api-key` header
`401 API_KEY_INVALID`	Key is wrong, revoked or expired
`403 AUTH_INSUFFICIENT_PERMISSIONS`	The key lacks the endpoint’s scope
`403 AUTH_METHOD_NOT_ALLOWED`	Wrong credential type for this endpoint: the Business Account API takes API keys, not dashboard tokens
`403 API_KEY_IP_NOT_ALLOWED`	Your server’s IP isn’t on the key’s allowlist

See Access and API keys for key creation, lifecycle and limits.