Authentication

API Keys

All OmnAPI requests authenticate via the x-api-key HTTP header.

GET /api/v1/tasks/job_01H... HTTP/1.1
Host: api.omnapi.com
x-api-key: sk_live_...

There is no Authorization: Bearer flow for the public API — that header is reserved for the dashboard session and not accepted by the gateway.

Getting a key

1. Sign in to omnapi.com.
2. Open Settings → API Keys.
3. Click Create key, label it, then copy the displayed secret.

You will only see the secret once. Store it in a password manager or your platform’s secret store.

Rotating a key

1. Create a new key first (so you have overlap).
2. Update your application to the new key.
3. Disable the old key from the dashboard.
4. After ≥ 24h of zero traffic on the old key, delete it.

Scoping & limits

Each key carries:

• A per-second rate limit (default: shared with your plan tier)
• A per-day request budget
• A per-month request budget

0 on any field means unlimited within plan limits. See Rate Limits.

Security model

	Stored in browser?	Sent with every request?	Visible to OmnAPI staff?
Dashboard session cookie	Yes (httpOnly)	dashboard.omnapi.com only	No (encrypted)
x-api-key from playground	Yes (localStorage)	docs playground only	No
x-api-key server-side	Up to you	Yes	Hashed at rest

The interactive playground stores keys only in your browser’s localStorage and sends them direct to api.omnapi.com. The docs site server (docs.omnapi.com) never sees your key.

Compromised key checklist

1. Disable the key from the dashboard immediately.
2. Review recent usage in Settings → Usage for unexpected calls.
3. Rotate any keys derived from the same source (e.g., copy-pasted into shared workspaces).
4. File a support ticket if you suspect leak through OmnAPI infrastructure.