Rebrandly Authentication: API Key Setup and Security (2026)

Authentication overview

Rebrandly provides a RESTful API designed for programmatic interaction with its branded link management services. The primary method for authenticating requests to the Rebrandly API is through the use of API keys. These keys serve as a credential that identifies and authorizes the calling application or user, granting access to specific API endpoints and resources based on the associated account's permissions. This approach simplifies integration for developers by relying on a single token for authorization, which must be securely transmitted with each API call.

The API supports operations such as creating custom short URLs, retrieving link analytics, and managing domains. All API communications are expected to occur over HTTPS to ensure that API keys and other sensitive data are encrypted in transit, protecting against eavesdropping and tampering. Developers are advised to consult the Rebrandly developer documentation for comprehensive details on API endpoints and request structures.

Supported authentication methods

Rebrandly's API relies exclusively on API keys for authentication. This method is suitable for server-side applications, scripts, and integrations where the API key can be stored securely and transmitted without exposure to client-side environments.

API keys are typically passed in the apikey header of HTTP requests. For example, a request might include apikey: YOUR_API_KEY. This method is a common practice for many APIs, offering a balance between ease of use and security when properly implemented. For a broader understanding of API key security, refer to general API key management guidance.

Getting your credentials

To obtain your Rebrandly API key, follow these steps:

1. Log in to Rebrandly: Access your Rebrandly account through the official Rebrandly website.
2. Navigate to Account Settings: Once logged in, locate and click on your profile icon or username, typically in the top right corner. From the dropdown menu, select 'Account Settings' or a similar option that leads to your account management page.
3. Find the API Keys Section: Within your account settings, look for a section labeled 'API Keys', 'Developer Settings', or 'Integrations'. This section is specifically designed for managing API access.
4. Generate a New API Key: If you do not have an existing API key, or if you need to generate a new one for security reasons (e.g., key rotation), there will be an option to 'Generate New Key' or 'Create API Key'. Click this button.
5. Copy Your API Key: After generation, your unique API key will be displayed. It is crucial to copy this key immediately and store it securely, as it may not be displayed again for security reasons. Treat your API key like a password.
6. Key Management: The API Keys section also typically provides options to revoke or regenerate existing keys. Regularly review your active API keys and revoke any that are no longer in use or are suspected of being compromised.

For the most up-to-date instructions and visual guidance, always refer to the official Rebrandly developer documentation on API key retrieval.

Authenticated request example

Below is an example of an authenticated request to the Rebrandly API using cURL. This example demonstrates how to create a new branded link by including the API key in the apikey header and sending a JSON payload.

curl -X POST \
  'https://api.rebrandly.com/v1/links' \
  -H 'Content-Type: application/json' \
  -H 'apikey: YOUR_API_KEY' \
  -d '{
    "destination": "https://www.example.com/long-url-to-shorten",
    "domain": { "fullName": "rebrand.ly" },
    "slashtag": "my-custom-link"
  }'

In this example:

• -X POST specifies the HTTP method.
• 'https://api.rebrandly.com/v1/links' is the API endpoint for creating links.
• -H 'Content-Type: application/json' indicates that the request body is in JSON format.
• -H 'apikey: YOUR_API_KEY' is where your actual Rebrandly API key must be inserted.
• -d '...' contains the JSON payload with the link's destination, desired domain, and an optional custom slashtag.

Replace YOUR_API_KEY with your actual API key and adjust the JSON payload according to your specific link creation requirements. Additional examples in other programming languages like Python, JavaScript, and Ruby can be found in the Rebrandly API reference documentation.

Security best practices

Securing your API keys and ensuring the integrity of your API interactions are paramount. Adhere to these best practices when working with Rebrandly API keys:

• Keep API Keys Confidential: Never hardcode API keys directly into client-side code (e.g., JavaScript in a web browser or mobile app). This exposes them to end-users and potential attackers. Store them in environment variables, secret management services, or secure configuration files on your server.
• Use Environment Variables: For server-side applications, load API keys from environment variables rather than committing them directly into your codebase. This prevents keys from being exposed in version control systems.
• Restrict Access: Limit access to API keys to only those individuals or systems that absolutely require them. Implement strict access controls on the systems where keys are stored.
• Regular Key Rotation: Periodically regenerate your API keys, ideally every 90 days or less. This minimizes the window of exposure if a key is compromised. Rebrandly's dashboard allows you to revoke old keys and generate new ones.
• Monitor API Usage: Regularly review your API usage logs for any unusual activity. Spikes in requests, requests from unexpected geographical locations, or attempts to access unauthorized resources could indicate a compromised key.
• Secure Communication (HTTPS/TLS): Always ensure that all API requests are made over HTTPS/TLS. This encrypts the data in transit, protecting your API key and request payloads from interception. Rebrandly's API endpoints are designed to enforce HTTPS.
• Error Handling: Implement robust error handling in your application. Avoid logging API keys in plain text if an error occurs.
• Principle of Least Privilege: If Rebrandly introduces more granular permissions for API keys in the future, configure keys with the minimum necessary permissions required for your application's functionality.
• Avoid Public Repositories: Never commit API keys or configuration files containing them to public code repositories like GitHub. Use .gitignore files to exclude sensitive files from version control.
• Consider a Proxy or Gateway: For enhanced security, especially in complex architectures, consider routing API requests through an API gateway or proxy server. This can add an additional layer of security, such as rate limiting, request validation, and centralized key management. Kong Gateway provides features for API security and access control that can be beneficial.

By following these best practices, you can significantly reduce the risk of unauthorized access and ensure the secure operation of your applications integrating with the Rebrandly API.