Skip to main content
Every request carries an API key as a Bearer token:
GET /v1/me answers which key is calling, for which organization, and what it spent today. It is free, so it is a good first call.

API keys

Create keys in the console, under API keys. A key is ob_live_ followed by 32 random characters and a 6-character checksum.
  • It is shown once. Copy it when you create it. Afterwards the console shows it masked, as ob_live_7Kx2…34hx.
  • It belongs to the organization, not to the person who made it, so a teammate leaving never breaks an integration.
  • Every call counts against the organization’s balance and rate limits, whichever key makes it.
Treat a key like a password. Never commit it, put it in client-side code or paste it in a ticket. If a key leaks, revoke it: in the console, or with POST /v1/me/revoke called with that key. Revoking takes effect on the key’s next call.

Scopes

A key’s scope decides what it may call. Every key can read its own account: GET /v1/me, the balance, prices, rate limits, its own usage and requests, and jobs. Reading the organization’s ledger (GET /v1/wallet/transactions), and another key’s usage or requests, needs a key with full access. A call outside the key’s scope answers 403 with insufficient_scope.

Daily spending caps

A key can have a daily spending cap, set in the console. A paid call that would take the key past its cap for the day answers 402 with key_daily_cap_reached, and nothing runs. Caps reset at midnight UTC. GET /v1/me and GET /v1/limits show what the key spent today and what is left of its cap.

Expiry

A key can be created with an expiry date. After it, calls answer 401 with api_key_expired.

When a key is refused

Calls without a valid key are rate limited by IP address, so a misconfigured client gets 429 once it keeps retrying.