RestoreCordDocs
HomeDashboard
Developer

API Keys

Create scoped RestoreCord API keys, send them as bearer tokens, and limit each key with permission bitfields, expiration dates and IP allowlists.

Key Format

RestoreCord API keys are automation credentials in the format <keyId>.<secret>. The key ID identifies the credential and the secret authenticates the request.

Authorization: Bearer <keyId>.<secret>

Store the full key only once when it is created. Rotate the key if it appears in logs, screenshots, repositories, browser code, or Discord messages.

Create and Manage Keys

API keys are created and managed in the RestoreCord dashboard. API credentials are for server-side integrations that call documented customer API endpoints.

SettingPurpose
NameUse a unique name that identifies the integration or job.
ExpirationChoose the shortest useful lifetime for the integration.
PermissionsGrant only the endpoint groups the integration needs.
IP allowlistRestrict access to fixed infrastructure when possible.

Authentication

  • Send the key in the Authorization header.
  • Use the Bearer prefix for consistency with the rest of the v3 API.
  • Use API keys from server-side code only; never ship them in browser bundles or public clients.
  • Expired, revoked, inactive, or IP-blocked keys are rejected.

Permissions

Permissions are a bitfield and are selected by name in the dashboard. Grant the smallest set your integration needs.

Permission Sets

PermissionValueAllows
READ_ACCOUNT1Read basic account information.
READ_SERVERS2List and inspect RestoreCord servers.
READ_MEMBERS4Read member records and member status.
READ_BOTS8Read bot metadata. Tokens and client secrets are hidden.
READ_ANALYTICS16Read analytics data.
WRITE_SERVERS256Create, update, and delete server settings.
WRITE_MEMBERS512Modify member records.
WRITE_BOTS1024Create, update, and delete custom bot records.
CREATE_BACKUPS65536Create snapshots and run snapshot migration operations.
RESTORE_BACKUPS131072List, inspect, delete, and restore snapshots.
SERVER_PULL1048576Pull authorized members into a Discord server.
SERVER_FIREWALL4194304Manage firewall rules, passwords, bypasses, logs, and imports.

READ_ACCOUNT is the safe baseline for most integrations. Add write, pull, backup, or firewall permissions only for jobs that need them.

Endpoint Access

Use the dedicated API reference pages for full request and response fields. This table maps API-key permissions to the major endpoint groups.

Endpoint groupCommon endpointsPermission
AccountGET /api/v3/usersREAD_ACCOUNT
ServersGET /api/v3/servers, GET /api/v3/servers/{serverId}READ_SERVERS
Migration statusGET /api/v3/servers/status, GET /api/v3/servers/{serverId}/migrations, GET /api/v3/servers/{serverId}/migrations/status, GET /api/v3/servers/{serverId}/migrations/estimateREAD_SERVERS
Migration controlPOST, DELETE, PATCH /api/v3/servers/{serverId}/migrationsSERVER_PULL
Server writesPOST /api/v3/servers, PATCH /api/v3/servers/{serverId}, DELETE /api/v3/servers/{serverId}WRITE_SERVERS
Verification linksGET, POST /api/v3/servers/{serverId}/verification-links, DELETE /api/v3/servers/{serverId}/verification-links/{linkId}READ_SERVERS for GET, WRITE_SERVERS for POST and DELETE
MembersGET /api/v3/servers/{serverId}/members, GET /api/v3/members/{userId}, GET /api/v3/members/{userId}/guildsREAD_MEMBERS
Member pullPUT /api/v3/servers/{serverId}/members/{userId}SERVER_PULL
BotsGET /api/v3/bots, POST /api/v3/bots, PATCH /api/v3/bots/{botId}, DELETE /api/v3/bots/{botId}, GET, POST /api/v3/bots/{botId}/guildsREAD_BOTS or WRITE_BOTS
SnapshotsGET /api/v3/snapshots, POST /api/v3/servers/{serverId}/snapshots, POST /api/v3/snapshots/{snapshotId}/restoreCREATE_BACKUPS or RESTORE_BACKUPS
Firewall/api/v3/servers/{serverId}/firewall/*SERVER_FIREWALL
Analytics/api/v3/servers/analytics, /api/v3/servers/firewall/analyticsREAD_ANALYTICS
Webhook eventsPATCH /api/v3/servers/{serverId} with webhookUrlWRITE_SERVERS plus Enterprise plan

Some actions only work from the dashboard, whatever permissions a key has. These include server ownership, sub-users and their invites, plans, checkout, coupons and trials, notifications, webhook secret generation, snapshot previews, migration logs and share links, OAuth checks, and member imports. API keys get 403 with This action requires a full session.

IP Allowlists

Restrict keys to fixed infrastructure when possible. Allowlist entries can be exact IP addresses or CIDR ranges.

203.0.113.10
198.51.100.0/24
2001:db8::/32

Safe Usage

Use one key per integration

Separate keys make it clear which system performed an action and let you revoke one integration without breaking others.

Keep destructive access isolated

Put WRITE_MEMBERS, WRITE_BOTS, SERVER_PULL, and backup restore permissions on dedicated keys, not read-only dashboard/reporting keys.

Handle API failure states

Automation should explicitly handle 401, 403, and 429 responses.

Next Steps

Full API Reference

Review global request behavior, schemas, errors, and rate limits.

Webhook Events

Verify signed event delivery from RestoreCord.

Full API Reference

Complete REST API behavior, schemas, and limits.

Webhook Events

Enterprise webhook payloads and signatures.

On this page

Key FormatCreate and Manage KeysAuthenticationPermissionsPermission SetsEndpoint AccessIP AllowlistsSafe UsageUse one key per integrationKeep destructive access isolatedHandle API failure statesNext Steps