Authentication

Every request is authenticated with a per-account API key in the X-Api-Key header.

Every request carries your key in the X-Api-Key header. There is no OAuth flow and no session cookie — a key is the whole credential.

X-Api-Key: onb_live_<key_id>_<secret>

Key shape#

A key is the prefix onb_live_ followed by a 16-character hex id, an underscore, then a 64-character hex secret. The id half is public (it identifies which key made a request in your dashboard); the secret half is shown to you exactly once and is never stored in recoverable form on our side.

Getting a key#

In the dashboard: /settings/integrations → API keys (inbound) → Create key. Copy it from the one-time "API key — copy it now, it won't be shown again" panel. Revoke a key from the same list at any time; you may hold up to 5 active keys, and issuing new ones is itself rate-limited to 10/hour per account.

What a key can do#

Failure modes#

A missing header, a malformed key, an unknown key, a wrong secret and a revoked key ALL return the identical 401 Unauthorized. This is deliberate — a response that told you "this key id exists but the secret is wrong" would let a caller enumerate live keys. If you get a 401, check the header is present and the whole key was copied correctly; there is nothing more specific to diagnose from the response alone.

A 503 This resource is temporarily unavailable. Try again shortly. means the service could not check your key at all — retry shortly. It says nothing about your key and is never a reason to rotate it.

• Always call over HTTPS.
• Never put your key in a URL (query string) — headers only.
• A 404 with an EMPTY body on every path (rather than any of the shapes above) means this API is switched off for this deployment, not that your key is wrong.