Keys & authentication
Create keys, send Authorization, and handle 401 / 403
A key identifies your account and determines which models you can reach. Create and revoke keys in the console.
The full value is shown only at creation time. If you lose it, revoke the key and create a new one — there is no way to recover it.
Never ship a key to the browser
Anything in client-side JavaScript, a mobile binary, or a public repository is readable by anyone. Call the API from your own backend and let your frontend talk to that instead.
A few habits that keep keys manageable:
- One key per environment. Separate development, staging, and production so revoking one does not take down the others.
- Load from the environment. Read
ORIENTX_API_KEYat runtime rather than hardcoding it. - Rotate on exposure. If a key reaches a log, a screenshot, or a commit, revoke it immediately.
Authentication
Every request carries the key in an Authorization header:
Authorization: Bearer <ORIENTX_API_KEY>A missing, malformed, or revoked key returns 401:
{
"error": {
"message": "Invalid API key provided.",
"type": "invalid_request_error",
"code": "invalid_api_key"
}
}If the key is valid but lacks access to the model you asked for, the response is 403 instead. See
rate limits & errors for the full status table.