Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/N3XT3R1337/RiftCE/llms.txt

Use this file to discover all available pages before exploring further.

The Rift CE web API uses a simple password-based authentication scheme. You configure the password in Settings → Web Server, then supply it with every request. Authentication is checked before any endpoint logic runs — a bad or missing credential short-circuits the request immediately.

​
Passing your password

There are two ways to authenticate:
1

HTTP header (recommended)

Add the X-Rift-Password header to your request:
curl -H "X-Rift-Password: yourpassword" http://localhost:7963/getaccounts
Prefer this method in scripts and automation — it keeps credentials out of URLs and server logs.
2

Query parameter (quick testing)

Append ?password=yourpassword to the URL:
curl "http://localhost:7963/getaccounts?password=yourpassword"
This is convenient for one-off testing in a browser address bar, but avoid it in production scripts.
Both methods are checked in order. If X-Rift-Password is present it takes precedence; otherwise the password query parameter is read.

​
Disabling authentication

Setting WebServerRequirePassword to false in Settings disables the password check entirely. All requests are accepted without any credential.
Only disable authentication if the server is strictly localhost-only (WebServerAllowExternal is off) and no other process on the machine should be able to interact with your accounts. Leaving authentication off while WebServerAllowExternal is enabled exposes your vault to anyone on your network.

​
401 Unauthorized

When WebServerRequirePassword is true and the supplied password does not match, the server returns: 
{ "error": "Unauthorized" }

​
Permission flags

Authentication grants access to the server — not necessarily to every endpoint. Each category of endpoint is independently gated by a permission flag in Settings → Web Server. Calling a disabled endpoint returns 403 Forbidden even with a valid password.
FlagDefaultEndpoints controlled
WebServerAllowGetAccountstrueGET /getaccounts
WebServerAllowGetCookiefalseGET /getcookie
WebServerAllowLaunchtrueGET /launchaccount
WebServerAllowEditingfalse/setalias, /setdescription, /setgroup, /getfield, /setfield, /removefield
{ "error": "Forbidden" }
WebServerAllowGetCookie and WebServerAllowEditing are off by default because they expose sensitive data or allow modifications to your vault. Enable them only when your automation genuinely requires them.

​
Examples

curl -H "X-Rift-Password: yourpassword" http://localhost:7963/getaccounts
Store your password in an environment variable and reference it in scripts rather than hardcoding it: curl -H "X-Rift-Password: $RIFT_PASSWORD" http://localhost:7963/getaccounts

Build docs developers (and LLMs) love

Get started for freeTalk to us