Getting started
Authentication
Every API request is authenticated with an API key sent as a Bearer token.
API keys
API keys look like ohsee-<prefix>-<secret>. Create and manage them from the API Keys page in your dashboard. The full secret is shown only once at creation, so store it securely.
Keep keys secret
Treat API keys like passwords. Do not commit them to source control or ship them in client-side code. Use them from a server or a trusted backend.
Authorization header
Send your key in the HTTP Authorization header on every request:
header
Authorization: Bearer ohsee-<your-key>Managing keys
You can create multiple keys (for example, one per environment) and revoke any key instantly from the dashboard. Revoking a key takes effect immediately, and any request using it will start returning 401.
Auth errors
401: the key is missing, malformed, or revoked.403: the account is disabled.
Error responses return a JSON body with a detail.error message. See Errors.