orientxorientx

Keys & authentication

Create keys, send Authorization, and handle 401 / 403

A key identifies your account and determines which models you can reach. Create and revoke keys in the console. You can view a key's value again from the console at any time.

Never ship a key to the browser

Anything in client-side JavaScript, a mobile binary, or a public repository is readable by anyone. Call the API from your own backend and let your frontend talk to that instead.

A few habits that keep keys manageable:

  • One key per environment. Separate development, staging, and production so revoking one does not take down the others.
  • Load from the environment. Read ORIENTX_API_KEY at runtime rather than hardcoding it.
  • Rotate on exposure. If a key reaches a log, a screenshot, or a commit, revoke it immediately.

Authentication

Every request carries the key in an Authorization header:

Authorization: Bearer <ORIENTX_API_KEY>

A missing, malformed, or revoked key returns 401:

{
  "error": {
    "message": "Invalid API key provided.",
    "type": "invalid_request_error",
    "code": "invalid_api_key"
  }
}

If the key is valid but lacks access to the model you asked for, the response is 403 instead. See rate limits & errors for the full status table.

Models & parameters

List the models this key can call, then set model on the request.

User Guide

Keys, authentication, limits, errors, and billing

Models & parameters

List models and the Chat Completions fields you will use most

On this page

Authentication