Authentication

Every request carries your API key. Keys look like this:

rb_live_a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90

rb_live_ followed by 64 hex characters, 72 in total. One key per account. It is shown in the Rayobyte dashboard under Browser then API access, masked until you reveal it.

Sending it

The x-api-key header works on every endpoint:

curl -G "https://browser.rayobyte.com/connect" \
  --data-urlencode "os=windows" \
  --data-urlencode "proxy=http://USERNAME:[email protected]:8000" \
  -H "x-api-key: rb_live_YOUR_KEY"

GET /connect also accepts the key as the token query parameter, for tools that take a URL and nothing else. A key in a URL ends up in shell history, CI logs and any proxy in front of you. Use the header.

Both SDKs take the key on the constructor and send it in the x-api-key header. The current releases also add it to the /connect URL as token, so the same logging caution applies to SDK traffic:

from rayobrowse import Rayobrowse

client = Rayobrowse(
    endpoint="https://browser.rayobyte.com",
    api_key="rb_live_YOUR_KEY",
)

import { Rayobrowse } from 'rayobrowse';

const client = new Rayobrowse({
  endpoint: 'https://browser.rayobyte.com',
  apiKey: 'rb_live_YOUR_KEY',
});

Rotating a key

Browser then API access in the dashboard has a rotate button. The old key stops working the moment the new one is issued, and anything still holding it gets 401 on its next call.

Sessions already running are untouched. Your CDP connection goes straight to the backend and never carries the key.

What comes back when the key is wrong

Status	Body	Meaning
401	Missing API key	No x-api-key header and no token parameter
401	Invalid API key	The key is not a live key on an active account
503	Authentication service temporarily unavailable	The key lookup failed. The key may be perfectly good

503 means the key lookup failed, not that the key is bad. Retry it. Rotating the key does not change the result.

All three are JSON, including on GET /connect, whose other errors are plain text.

Keeping it out of trouble

• Put it in an environment variable, not in source.
• A leaked key can launch browsers against your 48 hour allowance until it is rotated. Rotate first, investigate second.

See Limits for the 429 and 402 responses.