REST API Overview, Authentication & Security

Developer REST API Overview (api/v1)

The Botlify Developer REST API is unified under a single high-performance endpoint: https://botlify.cloud/api/v1. It accepts both HTTP GET and POST requests (URL-encoded form data or application/json payloads) to manage all user resources programmatically.

1. The 4 Authentication Mechanisms

Authenticate requests using any of the following 4 methods:

Method	Format	Example Header / Parameter
X-API-KEY Header (Recommended)	HTTP Request Header	`X-API-KEY: botlify_usr_98a72b1...`
Bearer Token	HTTP Authorization Header	`Authorization: Bearer botlify_usr_98a72b1...`
URL Query Parameter	GET Query String	`?token=botlify_usr_98a72b1...` or `?token=...`
JSON / Form Body	POST Request Body	`{"api_key": "botlify_usr_98a72b1...", "action": "list_bots"}`

2. Strict Transport Security & Rate Limiting

HTTPS Enforcement: All non-HTTPS requests are automatically redirected via HTTP 301 to https://botlify.cloud/api/v1 with HSTS enabled.
Sliding Window Rate Limiter: Allows up to 60 requests per minute per user account with burst allowances. If exceeded, returns HTTP 429 Too Many Requests with Retry-After headers.

HTTP Headers — Rate Limit Telemetry

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1774312800
RateLimit-Remaining: 58

3. System Health & Public Unauthenticated Endpoints

Action Name	Auth Required?	Purpose & Output
`action=ping`	Yes	Returns `{"ok": true, "message": "pong", "timestamp": 1774312800}`
`action=public_links`	No (Public)	Returns official support, community group, and announcement channel links.
`action=token`	Yes	Generates OAuth 2.0 Bearer token payload with `scope="mcp:read mcp:write mcp:tools mcp:full"`.
`action=introspect`	Yes	Introspects current API token validity and active scope.