# Ora API

> Run launches, trades and strategies from your own scripts, with the same endpoints the Ora app uses.

Authenticate with an API key, send JSON, get JSON back.

> **Danger:** **There is no test mode.** Every call acts on mainnet with real funds, exactly like the app. Start with read-only calls, then small amounts.

**Base URL:** `https://api.useora.xyz`. Every path in this section is relative to it.

### Quickstart

1. **Get API access turned on.** It is off by default on every account. Ask Ora support to turn it on for your account, on [Discord](https://discord.gg/K9BrY9g6zs) or [Telegram](https://t.me/useora_xyz).
2. **Create a key.** In the app, click your profile picture at the top right, then **API Key**, then **Generate key**. The key is shown once: copy it into a secret store or an environment variable. Generating a key means you accept the API Terms of Use, sections 10.8 to 10.11 of Ora's [Terms of Service](https://useora.xyz/terms).
3. **Make your first call.** A `200` means you're in. A `401` means the key is wrong; a `403` means API access isn't on yet.

```bash
curl https://api.useora.xyz/portfolio/stats \
  -H "Authorization: Bearer $ORA_API_KEY"
```

### A small client

For anything beyond a one-off, wrap the calls in a small client. The examples in this section assume this one (Node 18+, or any runtime with `fetch`):

```js title="ora.mjs"
const ORA = 'https://api.useora.xyz';
const KEY = process.env.ORA_API_KEY; // ora_…, never hard-coded

export async function ora(method, path, body) {
  const res = await fetch(ORA + path, {
    method,
    headers: {
      Authorization: `Bearer ${KEY}`,
      // Only when there is a body: a body-less POST with this header is refused (400).
      ...(body ? { 'Content-Type': 'application/json' } : {}),
    },
    body: body ? JSON.stringify(body) : undefined,
  });
  const data = await res.json();
  if (!res.ok || data.success === false) {
    const err = new Error(`${res.status} ${data.error}${data.message ? `: ${data.message}` : ''}`);
    err.status = res.status;
    err.requestId = res.headers.get('x-request-id'); // quote it when you contact support
    throw err;
  }
  return data;
}
```

### Where to go next

- [Authentication](https://docs.useora.xyz/developers/authentication/): how the key works, and how to rotate or revoke it.
- [Requests & Errors](https://docs.useora.xyz/developers/requests-and-errors/): amounts, addresses, error codes and rate limits.
- [Signing & Streams](https://docs.useora.xyz/developers/signing-and-streams/): the few flows your own wallet signs, and live data.
- [API Guides](https://docs.useora.xyz/developers/guides/): buy and sell, strategies, launch a token.
- [Endpoints](https://docs.useora.xyz/developers/endpoints/): every route a key can call.

Questions and access requests go to Ora support. Quote the `X-Request-ID` of any call you ask about.