Skip to main content
Realsee
日本語
Documentation
  1. Docs
  2. Authentication

Authentication

Use Developer app AK/SK to obtain an access token and call OpenAPI securely from your server.

View Markdown
On this page

Use your Developer app's AK and SK on your backend to obtain an access token for Realsee OpenAPI.

Read Get Started to run the Public Demo without an account or keys. To use your own Team's data, sign in and Open Apps.

Developer app credentials

Select the owning Team in Apps, then create or open a Developer app to get its credentials:

  • App key (AK) — the stable credential shown in the dashboard and used by browser-safe SDK flows where supported.
  • App secret (SK) — the server-side secret supplied to the gateway token exchange.

Treat the app secret like a database password. Keep it on your server, never place it in browser bundles, and avoid logging it.

App secret handling

Open the app in its owning Team and complete the reCAPTCHA check to reveal its secret. The secret is visible for 30 seconds only and automatically hides when you leave the page, switch Teams, hide the tab, or switch windows. Keep it out of browser storage (localStorage or sessionStorage), URLs, logs, and support messages.

Use the credentials shown in Apps for your selected Team.

Exchange AK/SK for a gateway token

Run the exchange on your backend using the owning app's AK and SK:

curl --request POST 'https://app-gateway.realsee.ai/auth/access_token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode "app_key=$REALSEE_APP_KEY" \
  --data-urlencode "app_secret=$REALSEE_APP_SECRET"

The successful response includes data.access_token and data.expire_at, a Unix timestamp in seconds. Inspect the HTTP and business result before using the token. Cache it server-side until shortly before the returned expiry, then run the same credential exchange again. Do not assume a fixed lifetime or a separate refresh-token/rotation API.

Send the token's raw value as Authorization: YOUR_ACCESS_TOKEN for documented /open requests, without a Bearer prefix. This header authenticates the app; your backend must still authorize its own users and the resources it returns. The OpenAPI endpoint guide provides the read-only Team resource-list call, which can succeed with an empty list when there are no suitable VRs.

Browser and server boundary

Safe in browser code:

  • Public app key values where the SDK flow explicitly supports them.
  • Public open-work demo data.

Server-only:

  • App secret.
  • Access tokens minted from app credentials.
  • Gateway token exchange and authenticated OpenAPI requests.

If a browser app needs OpenAPI data, route the call through your own backend. Your server holds the secret, exchanges credentials for a token, authorizes its users, and returns only the data its UI needs.

Next steps

  • Get Started — render the Public Demo first, then optionally connect Team data.
  • Team and App Management — understand Team scope and request history.
  • OpenAPI — call OpenAPI from server-side code with provisioned credentials.