API keys and the public API

The public API lets other systems work in your workspace without signing in as a person. An n8n flow can create a task when a recording finishes, a script can pull last month’s hours, a form can record what the client approved over WhatsApp.

It is the other half of webhooks: webhooks tell your tools that something happened in RecReview, the API lets your tools act in RecReview.

Before you start: the API needs a paid Studio subscription — not Creator, not Pro, and not the free trial. Only workspace owners and admins can create keys.

Create a key

1. Click your avatar at the top right and choose Workspace Settings.
2. Under Advanced, open the API tab.
3. Click New key.
4. Give it a Name, such as n8n — recordings. This is the name that shows up as the author of everything the key does.
5. Under Permissions, tick only what the automation needs.
6. Under Expires, pick Never, In 30 days, In 90 days or In 1 year.
7. Click Create key.
8. Copy the key under Copy your key now and store it in your automation tool. Then click I stored it.

Warning: This is the only time the full key is shown. RecReview can’t show it to you again. If you lose it, create a new key and revoke the old one.

A workspace can have up to 20 active keys at once. Revoked and expired keys don’t count.

Permissions

A key can only do what you tick. Anything else is refused.

Changing a task’s client or project isn’t possible through the API — that would change the video code and the portal where the task appears.

Use the key

Every request goes to https://rec.review/api/v1 and carries the key in the Authorization header:

Authorization: Bearer rr_live_...

Request and response bodies are JSON. Fields the API doesn’t know are refused, so a typo doesn’t get silently ignored.

To check that the key works, call GET /me. It answers with the key’s name, its permissions and the workspace it belongs to. Each key belongs to one workspace, so you never pass a workspace id.

Example: create a task

curl -X POST https://rec.review/api/v1/tasks \
  -H "Authorization: Bearer $RECREVIEW_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: recording-1234" \
  -d '{
    "title": "Edit — Lesson 3",
    "projectId": "<project id>",
    "dueDate": "2026-10-30T15:00:00.000Z",
    "attachments": [
      { "type": "link", "name": "Transcript", "url": "https://drive.google.com/..." }
    ]
  }'

The task goes through the same checks and the same Task created automations as one created in the app. Send "kind": "gallery" to create a photo gallery task instead.

The Idempotency-Key header is optional but worth sending. Base it on the event that triggered the automation. If the same request arrives twice, RecReview returns the task it already created instead of making a duplicate.

Other useful calls

Recording a verdict has the same effect as recording it from the review screen: it releases the client blocker, runs your automations and, on approval, sends the final delivery e-mail and the video.delivery_approved webhook. It only works on the latest version.

Keep the key out of sight

In n8n, store the key as a Header Auth credential — name Authorization, value Bearer rr_live_... — and select that credential in the HTTP Request node. Don’t paste the key straight into a node or an expression: it would leak into exported workflows and execution history.

Limits

• 120 requests per minute per key.
• 2,000 tasks created through the API per workspace every 24 hours.
• Too many failed sign-in attempts from the same address are blocked for a few minutes.

Going over a limit returns a 429 error. Wait and try again.

What the key leaves behind

Everything a key does is signed with its name. In a task’s activity log the author shows as the key name followed by (API) — for example, n8n — recordings (API) — so anyone on the team can tell what came from an automation.

The API tab lists every key with its permissions, who created it, when it was Last used and when it expires.

When a key stops working

• Revoked. Click Revoke on the key and confirm with Revoke key. Automations using it stop immediately. This can’t be undone.
• Expired. The expiry date you picked has passed.
• Its creator left the admins. A key only works while the person who created it is still an owner or admin of the workspace. If they are removed, archived, suspended or moved to another role, the key shows as Inactive. An admin needs to create a new one.
• The plan changed. If the workspace leaves Studio, or the subscription is canceled, unpaid or paused, every key stops working until the subscription is back. A payment that is late and still being retried does not stop the keys.

Failed requests return an error code — such as api_key_revoked, api_key_expired, api_key_creator_inactive, insufficient_scope or plan_required — so your automation can tell which case it hit.