# REST API Overview, Authentication & Security

> Unified developer endpoint at api/v1 with rate limiting, HTTPS enforcement, OAuth token introspection, and authentication methods.

**Category:** REST API Reference  
**URL:** https://docs.botlify.cloud/api-auth  
**Platform:** Botlify Cloud (https://botlify.cloud)  

---

## Developer REST API Overview (api/v1)

   

The **Botlify Developer REST API** is unified under a single high-performance endpoint: `https://botlify.cloud/api/v1`. It accepts both HTTP GET and POST requests (URL-encoded form data or `application/json` payloads) to manage all user resources programmatically.

   

## 1. The 4 Authentication Mechanisms

   

Authenticate requests using any of the following 4 methods:

   
    
| Method | Format | Example Header / Parameter |
| --- | --- | --- |
| X-API-KEY Header (Recommended) | HTTP Request Header | X-API-KEY: botlify_usr_98a72b1... |
| Bearer Token | HTTP Authorization Header | Authorization: Bearer botlify_usr_98a72b1... |
| URL Query Parameter | GET Query String | ?token=botlify_usr_98a72b1... or ?token=... |
| JSON / Form Body | POST Request Body | {"api_key": "botlify_usr_98a72b1...", "action": "list_bots"} |

   

   

## 2. Strict Transport Security & Rate Limiting

   
    
- HTTPS Enforcement: All non-HTTPS requests are automatically redirected via HTTP 301 to https://botlify.cloud/api/v1 with HSTS enabled.

    
- Sliding Window Rate Limiter: Allows up to 60 requests per minute per user account with burst allowances. If exceeded, returns HTTP 429 Too Many Requests with Retry-After headers.

   

   
```php
HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1774312800
RateLimit-Remaining: 58
```

   

## 3. System Health & Public Unauthenticated Endpoints

   
    
| Action Name | Auth Required? | Purpose & Output |
| --- | --- | --- |
| action=ping | Yes | Returns {"ok": true, "message": "pong", "timestamp": 1774312800} |
| action=public_links | No (Public) | Returns official support, community group, and announcement channel links. |
| action=token | Yes | Generates OAuth 2.0 Bearer token payload with scope="mcp:read mcp:write mcp:tools mcp:full". |
| action=introspect | Yes | Introspects current API token validity and active scope. |