Skip to content

API authentication

Every OrderCore request authenticates with an API key. Two header forms, a one-call preflight, machine-readable scope and expiry warnings.

Send the key on every request

Either header form works — pick one and stay consistent:

terminal
curl -H "X-API-Key: oc_live_..." https://api.ordercore.ai/v1/account/auth
curl -H "Authorization: Bearer oc_live_..." https://api.ordercore.ai/v1/account/auth

No key yet? Get one at /bootstrap — two fields, no payment. Issuance completes after e-mail verification via support.

Preflight: GET /v1/account/auth

The first authenticated call an agent or integration should make. It verifies the key and returns everything a client needs to configure itself:

json
{
  "tenant_slug": "demo",
  "auth_mode": "x-api-key",
  "api_key_scopes": ["read", "write"],
  "has_write_scope": true,
  "rate_limit_per_minute": 240,
  "api_key_expires_in_days": 31,
  "api_key_expiry_status": "ok",
  "auth_warnings": []
}

auth_warnings is machine-readable — handle these codes in client startup checks:

Scopes

Keys carry read and/or write scopes. Writes (orders, inventory adjustments, webhook endpoints) require write. Empty-scope keys are blocked in production by default.

Key lifecycle

List, revoke, and rotate keys via /v1/account/api-keys (see the full API guide). Rotation issues a new secret and keeps the old one valid for a grace window so deployed agents don't break mid-flight.

Related

Get an API key