> ## Documentation Index
> Fetch the complete documentation index at: https://direct-api.reap.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Send your API key in the x-api-key header on every request. Scopes decide which endpoints a key can call.

Send your API key in the `x-api-key` header on every request:

```bash theme={"system"}
curl "https://api.global.direct.reap.global/2026-07-13/team-members" \
  -H "x-api-key: YOUR_API_KEY"
```

> [!WARNING]
>
> Keep keys server-side. A key in a browser or mobile app is a leaked key;
> revoke it and rotate. Store keys in a secrets manager, and keep the IP
> allowlist on.

## Scopes

Each endpoint requires a scope; it's listed at the top of the endpoint's
page. A key's scopes can be edited at any time after the key is created:
an admin updates it in the dashboard. New scopes are never added to
existing keys automatically.

| Scope | Endpoints it unlocks |
| - | - |
| `team_members:read` | `GET /team-members` |
| `cards:read` | `GET /cards*`, `GET /cards/categories`, `GET /cards/transaction-categories` |
| `cards:write` | `POST /cards`, `PUT /cards/{cardId}`, `DELETE /cards/{cardId}`, freeze/unfreeze, restriction |
| `cards:read_vault` | `POST /cards/{cardId}/reveal` |
| `spend_controls:write` | `PUT /cards/{cardId}/spend-control` |
| `card_account_balances:read` | `GET /cards/balances` |
| `card_activities:read` | `GET /cards/activities` |
| `treasury_funding:read` | `GET /treasury/funding-options`, `GET /treasury/funding-instructions` |
| `treasury_funding:write` | `POST /treasury/bank-transfer-confirmations` |
| `treasury_transactions:read` | `GET /treasury/transactions` |

`GET /health` needs no scope; any valid key works.

When the MCP server launches (coming soon), it uses the same API keys and scopes, and the key's IP allowlist applies to MCP calls too, from wherever the tool runs.

## Auth errors

| Response | Meaning |
| - | - |
| `401 AUTH_CREDENTIAL_MISSING` | No `x-api-key` header |
| `401 API_KEY_INVALID` | Key is wrong, revoked or expired |
| `403 AUTH_INSUFFICIENT_PERMISSIONS` | The key lacks the endpoint's scope |
| `403 AUTH_METHOD_NOT_ALLOWED` | Wrong credential type for this endpoint: the Business Account API takes API keys, not dashboard tokens |
| `403 API_KEY_IP_NOT_ALLOWED` | Your server's IP isn't on the key's allowlist |

See [Access and API keys](/getting-started/access-and-api-keys.md) for key
creation, lifecycle and limits.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.