Authentication and keys
Every request except the OpenAPI document sends a bearer key.
The header
Authorization: Bearer rfl_live_… or rfl_test_…. The key is 256 bits of randomness. Refillo stores a hash and a short prefix. It cannot show the key again.
Rotation
Rotate a key in Settings. The old key keeps working for the grace period you choose, then stops. Two keys work during that window.