Authentication

Every request requires a partner-scoped API key, sent in the X-API-Key header.

X-API-Key: rip_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

rip.fun issues one key per partner, each with a set of scopes. A request whose key lacks the required scope is rejected with 403 Insufficient permissions.

Scopes

Scope	Grants
`read:catalog`	catalog, odds, feeds, card pricing
`wallet:read`	balance, ledger, deposits
`wallet:deposit`	get/create a deposit address
`packs:purchase`	custodial + non-custodial purchase
`packs:read`	purchase status / history, stats, buyback + redemption status
`packs:buyback`	create buyback offers
`cards:redeem`	redemption quote / prepare / submit
`pool:manage`	get/set the buyback pool wallet — exclusive: only keys explicitly granted this scope can use it
`webhooks:manage`	register / list / delete webhooks, delivery log

Tenant keys

The Tenant orders endpoints (/api/v1/shipping-quote, /api/v1/orders) are a separate product. They use a tenant API key, not the scoped mystery-partner key above. A tenant key is bound to one tenant and carries no scopes — those endpoints only check that the key is tenant-scoped. A mystery-partner key (including this demo's staging key) gets a 403 there, and a tenant key can't call the scoped mystery endpoints. To try the Tenant orders runners, paste a tenant key into the sidebar API key field.

Key handling

Server-side only. Never embed the key in browser or mobile code — proxy API calls through your own backend, exactly like these docs do (the "Try it" runners go through this demo's whitelisted server proxy, so the key never reaches your browser).
Store the key in a secrets manager / environment variable, not in source control.
Rotate keys via rip.fun if you suspect exposure; keys can carry an expiry.

Test with your own key

By default, every "Try it" runner uses this demo's built-in staging demo key. If you have your own partner key, paste it into the API key field at the top of the sidebar and every runner (and the generated curl snippets) will use it instead. It's a quick way to check that your key works and has the scopes you expect: a 401/403 from a runner then points to the key or a missing scope.

The key is kept only in this browser tab (sessionStorage — gone when the tab closes; the Clear button wipes it immediately).
It is sent only to this demo's own server proxy, which forwards it as the X-API-Key header to the whitelisted Mystery Pack API paths — never to any third party, and it is never logged or stored server-side.
Server-rendered example responses on page load still use the demo key; your key is only used when you press Run.

Rate limits

120 requests / minute per API key, shared across the whole /api/v1 surface. In addition, some endpoint families have per-key concurrency caps: purchase / buyback / redemption writes are limited to 5 concurrent requests, and wallet reads to 10 concurrent. Requests beyond a limit are rejected — back off and retry.