Authentication

Public integration endpoints use an API key. Include it in every request using the X-API-Key header.

X-API-Key: YOUR_API_KEY

API keys are linked to a Remy merchant and integration configuration. Keep keys on your server, store them in a secret manager or environment variable, and never expose them in browser code or commit them to source control.

Use the authentication endpoint to test a key:

curl "https://api.remyrewards.co.uk/v1/public/auth" \
  -H "X-API-Key: YOUR_API_KEY"

A missing or invalid key returns an error response. Remy also requires clients to send a User-Agent; standard HTTP libraries do this automatically.