API keys

Create a key

1. Sign in and open API Keys.
2. Select Create key.
3. Give the key a name that identifies its application and environment.
4. Keep the default basic permission unless your OrbitalsAI account has been configured differently.
5. Copy the full key immediately. It is shown once.

An account can have up to five active keys.

Store the key

For local development:

export ORBITALSAI_API_KEY="your_api_key"

For production, use the secret store provided by your hosting platform. Never commit .env files containing real keys.

Rotate a key

1. Create a replacement key.
2. Update the secret in every service that uses the old key.
3. Confirm requests succeed with the replacement.
4. Revoke the old key.

There is no operation that reveals an existing full key. Create a replacement if the value is lost.

Revoke a key

Use Revoke on the API Keys page. Revocation is immediate and requests using that key will return 401.

Common mistakes

• Sending the key without the Bearer prefix on REST requests.
• Exposing the key in frontend code or source control.
• Reusing one key across development and production.
• Revoking the old key before all services have received its replacement.

Next steps

• Authentication
• Quickstart
• Python SDK