Authentication

Every data request needs an API key in the x-api-key header. There is no OAuth and no query-string key: header only, so keys do not end up in logs and browser history.

shell

curl "https://api.onekey.dev/v1/account" -H "x-api-key: YOUR_API_KEY"

Your keys#

Keys start with ok_live_ (real usage) or ok_test_.
A key is shown once, when you create it. Copy it then. We store only a hash, so we cannot show it again.
Create, label and revoke keys in your dashboard. Revoke a key the moment you suspect a leak; it stops working immediately.
1,000 free credits cover the open-platform endpoints. Hard-to-reach platforms (X, TikTok, Instagram, Reddit, and others marked on their page) need a verified email and a purchased pack. All keys on an account share one balance.

Keep it safe#

Call Onekey from your server, not from browser code. Anything in a browser bundle is public.
Read the key from an environment variable. Do not commit it.
Use one key per app so you can revoke one without breaking the rest.

What happens with a bad key#

You get 401 unauthorized. Repeated bad attempts from one address are rate limited (429), so a loop that retries a wrong key will get slower, not faster. See Errors.