How to Create and Manage RukkyHub API Keys

How to Create and Manage RukkyHub API Keys

An API key is a credential that allows an application to authenticate requests to the RukkyHub API. Your API key and its assigned permissions determine which documented operations your integration can perform.

This guide explains how to activate API access, generate a key, select appropriate permissions, configure security restrictions, and manage your credentials safely.

For the official instructions, visit the RukkyHub API Authentication Guide.

What Is a RukkyHub API Key?

A RukkyHub API key is a credential used to authenticate API requests. Depending on the permissions assigned to the key and your API access plan, it can authorize operations involving SMM services, VTU transactions, gift card trading, and other documented API features.

API keys should be treated like passwords. Anyone who obtains an active key may be able to perform operations permitted by its assigned scopes.

Before Creating an API Key

Before generating a key, make sure you have completed the required access steps:

• Sign in to your RukkyHub account.
• Open the Developer Portal located in your account settings. To access your account settings please click your profile. Then select settings and scroll down to locate API portal.
• Purchase an available API access plan if required. Usually in between $1  for protecting our API from fraudulent activities.
• Complete any required KYC or verification steps, only if required.
• Wait for approval if your API access requires administrative approval.
• To access the API, please note that manual approval may be required. Please be patient, an automatic email will be sent once your API access has been approved. If further information is required, you will be informed via email.

API features depend on your plan, account status, and the permissions available to your integration.

Step 1: Open the API Keys Section

1. Sign in to your RukkyHub account.
2. Navigate to the Developer Portal in your account settings.
3. Open the API Keys section.
4. Select the option to create or generate a new API key.

The wording of the button may vary as the developer interface evolves. Follow the current instructions displayed in your portal.

Step 2: Name Your API Key

Choose a descriptive name that identifies the application, website, or integration that will use the key.

For example, you could use names such as:

• Production Website
• Reseller Application
• Internal Business Dashboard
• Development Integration

Using a clear name makes it easier to identify the purpose of each credential when reviewing your API key settings.

Step 3: Select the Required API Scopes

Scopes are permissions that determine which API actions a key can perform. Select only the permissions required by the application associated with the key.

Examples of documented RukkyHub scopes include:

• services — List available SMM services.
• add — Place SMM orders.
• status — Check SMM order status.
• cancel — Request SMM order cancellation.
• balance — Check the account balance.
• vtu_data_plans — List supported data plans.
• vtu_airtime — Purchase supported airtime services.
• vtu_data — Purchase supported data plans.
• vtu_status — Check VTU transaction status.
• giftcard_cards — List available gift card types and rates.
• giftcard_trade — Submit a gift card trade.
• giftcard_trades — View gift card trade history.

Other scopes are available for additional documented operations, including other VTU services. Check the official Authentication Guide for the complete and current list.

Security recommendation: Do not enable every scope by default. A website that only needs to list services should not automatically receive permission to purchase services or submit transactions.

Step 4: Enter Your PIN and Generate the Key

1. Review the key name and selected scopes.
2. Enter your PIN when requested by the Developer Portal.
3. Submit the key creation request.
4. Copy the generated API key immediately.
5. Store it in a secure location accessible only to authorized systems or personnel.

Important: RukkyHub displays the generated key only once. Save it securely when it is created. Do not assume that you can return to the portal later to reveal the same secret.

Step 5: Store Your API Key Securely

API keys must be protected from unauthorized access. Use a server-side environment variable or an appropriate secrets-management system.

For example, a server application may read a key from an environment variable named RUKKYHUB_API_KEY. The variable name is an example you can choose for your own application.

Follow these security practices:

• Never publish your live API key in public source-code repositories.
• Do not embed private keys in frontend JavaScript, public HTML, or client-side application bundles.
• Avoid sharing keys through ordinary chat messages or email.
• Limit access to authorized developers and server processes.
• Remove credentials from application logs, screenshots, and error reports.
• Use HTTPS when making API requests.

Step 6: Authenticate Requests With Your Key

The recommended RukkyHub API authentication method is to send your key in the X-API-KEY HTTP header.

Example using cURL:

curl -X POST "https://developers.rukkyhub.com/api/v1" \  -H "X-API-KEY: YOUR_API_KEY" \  -H "Accept: application/json" \  -d "action=balance"

Replace YOUR_API_KEY with your actual key. Run this example from a secure environment and do not publish the real credential.

The authentication documentation also describes sending the key through the POST body using the key parameter. Prefer the recommended header method unless your integration has a documented reason to use the alternative.

Step 7: Configure IP or Domain Restrictions

RukkyHub supports IP address or domain restrictions for API keys. These controls help limit where a key can be used.

To configure restrictions:

1. Open the API Keys section in the Developer Portal.
2. Locate the relevant key and open its security settings.
3. Find the API Key Security settings or modal.
4. Configure the available IP or domain restrictions for your integration.
5. Save your changes and test the integration using the intended environment.

If a domain whitelist is enforced, the API may require an origin value supplied through the X-API-ORIGIN header or a supported origin or domain request parameter.

Server-to-server requests made through tools such as cURL or Postman may need an explicit X-API-ORIGIN header when domain restrictions are enforced. Review the official authentication documentation to choose the appropriate restriction for your integration.

Step 8: Understand API Key Errors

If a request fails, check the returned error message and verify the key configuration.

• Invalid API key: The key may be incorrect, revoked, or unrecognized.
• Action not allowed: The key may not have the scope required for the requested action.
• API access not enabled: Your current plan may not include the requested service.
• Domain restriction error: The request origin may not match the configured whitelist.
• Missing API key: Check that the credential is being sent using a supported authentication method.

Use the official RukkyHub Error Codes Guide to troubleshoot the specific response you receive.

Step 9: Revoke a Compromised API Key

If your API key is exposed, shared with an unauthorized person, or suspected of misuse, revoke it immediately.

1. Open the Developer Portal and navigate to API Keys.
2. Identify the affected key.
3. Use the available revocation option.
4. Confirm the action if prompted.
5. Review any applications that depended on the revoked key.
6. Generate a replacement key with the required scopes and update your secure server configuration.
7. Investigate possible unauthorized requests and contact Support if necessary.

According to the RukkyHub authentication documentation, revoked keys stop working immediately. Applications using the old key must be updated before they can authenticate successfully again.

API Key Management Best Practices

• Use separate keys for different applications when appropriate.
• Choose descriptive names that identify each key's purpose.
• Assign only the required scopes.
• Configure appropriate IP or domain restrictions.
• Keep all API credentials out of public code and client-side applications.
• Review key usage and investigate unexpected activity where these details are available.
• Revoke keys that are compromised or no longer required.
• Keep a record of which applications need to be updated if a key is replaced.

Frequently Asked Questions

Where do I create a RukkyHub API key?

Open your RukkyHub dashboard, navigate to Developer Portal, and select API Keys after satisfying the applicable API access requirements.

Can I view my API key again after creating it?

The generated key is shown only once. Store it securely when it is created. If it is lost, follow the portal's supported key-management process to generate a replacement if necessary.

What happens if I select the wrong scopes?

Your key may be unable to perform the actions your application requires, or it may have more permissions than necessary. Review the available key-management options and create a suitably scoped key when needed.

Can I use one API key for every application?

That depends on your security and integration requirements. Separate keys can make access control, troubleshooting, and revocation easier when different applications have different needs.

What happens when an API key is revoked?

The revoked key stops working immediately. Update any dependent applications with a replacement credential before they can authenticate again.

How do I restrict API access to my server or domain?

Use the IP or domain whitelist controls available in the Developer Portal and follow the official authentication instructions for sending any required origin information.

Official RukkyHub Developer Resources

• Authentication and API Key Management
• Getting Started With the API
• API Reference
• API Error Codes

Need Help With Your API Key?

If you cannot generate a key, your integration is rejected, or you suspect unauthorized access, contact RukkyHub Support through an official support channel. Describe the problem and include the relevant error message, but never send your full API key, password, or PIN.

Important: Always check the current Developer Portal instructions before changing API key permissions, restrictions, or credentials.