Authentication
Authenticate REST, SDK, and WebSocket requests with an API key.
Create keys in API Keys in the dashboard. Product APIs accept the key as a bearer credential.
Python SDK
Use ORBITALSAI_API_KEY consistently across local development and deployed environments.
HTTP
WebSocket
Pass the key through the realtime endpoint's token query parameter:
Build the URL immediately before connecting. Use wss:// and configure application and proxy logs not to retain query strings.
Keep keys private
- Store keys in server-side environment variables or a secret manager.
- Never put a key in browser JavaScript, a mobile binary, a public repository, or logs.
- Use a separate key for each application or environment.
- Revoke a key immediately if it may have been exposed.
Dashboard login sessions are required for account, billing, support, and API-key management. API keys cannot manage other keys.