Skip to main content
Every call sends a bearer token in the Authorization header:
There are two kinds of token:
  • An API key acts as the admin who made it. Use it for your own scripts and integrations.
  • An OAuth access token acts as the member who connected the app. Use it for an app that each person connects as themselves.
Both carry scopes. Both share the same rate limit of 120 requests a minute.

​
API keys

​
Make a key

  1. Open Settings > API and MCP.
  2. Under API keys, select New key.
  3. Give the key a name.
  4. Choose its access: All, Read only or Restricted. Restricted lets you pick read or write for each area.
  5. Select Create key and copy it.
We show a key once, when you make it. Store it somewhere safe. If you lose it, revoke it and make another.
  • Keys start with rbk_org_live_.
  • Only admins can make or revoke keys. Every member can see the list of keys.
  • A firm can have 25 active keys.
  • The list shows each key’s name, access, who made it and when it was last used.

​
Who a key acts as

A key acts as the admin who made it. Changes it makes are recorded against that admin. A key can make admin-only calls. If the admin who made a key leaves the firm, the key stops working. Calls fail with 403 member_removed. Make a new key from an admin who is still in the firm.

​
Revoke a key

Select Revoke next to the key in Settings > API and MCP. Anything using the key stops working straight away. This cannot be undone.

​
OAuth for apps

An app can ask a member to connect it to their firm. The app then acts as that member, with that member’s role. If the member is not an admin, the app cannot make admin-only calls. Advisor is a standard OAuth 2.1 authorization server:
  • Authorization code flow with PKCE (S256 only).
  • Public clients only, with no client secret.
  • Dynamic client registration.

​
Discovery

All paths are on https://advisor.redbark.com.

​
The flow

  1. Register your app at /oauth/register with its name and redirect addresses.
  2. Send the member to /oauth/authorize with client_id, redirect_uri, response_type=code, code_challenge, code_challenge_method=S256 and resource=https://advisor.redbark.com/api/v1. Add scope to suggest the scopes you want.
  3. The member signs in, picks the firm and chooses the access the app gets.
  4. Exchange the returned code at /oauth/token.
  5. Call the API with the access token. Refresh it with the refresh token when it expires.
Ask for the resource https://advisor.redbark.com/api/v1. A token is bound to one API. A request that names no resource gets a token for the MCP server, which the REST API refuses.

​
Tokens

  • Using a code or a refresh token twice ends the connection.
  • The member’s role is checked on every request. A role change takes effect on the next call.
  • A member who is removed from the firm loses access straight away.

​
Redirect addresses

  • http://localhost, http://127.0.0.1 and http://[::1] are accepted for apps on the same machine, on any port.
  • A hosted https address must be on a host we have approved. Contact support to have your app added.
  • Up to 10 addresses per app.

​
Ending a connection

A member can disconnect their own apps under Connected apps in Settings > API and MCP. An admin can disconnect anyone’s. The app stops working straight away. An app can also end its own connection by sending its refresh token to /oauth/revoke.

​
Scopes

A scope is an area and a level: <area>:read or <area>:write. A write scope includes its read scope.
  • All gives every read and write scope.
  • Read only gives every read scope and no write scope.
  • A call without the scope it needs fails with 403 insufficient_scope. The message names the scope.
Scopes and roles are separate checks. A call needs the scope, and an admin-only call also needs an admin. See admin-only calls.

​
Failed authentication

A 401 carries a WWW-Authenticate header that names the protected resource metadata, so an OAuth client can find where to sign in.