Authentication

Your API key

Send your key on every request, in the Authorization header:

Authorization: Bearer ora_YOUR_API_KEY

• Format. ora_ followed by 43 characters (letters, digits, - and _), 47 in total. Anything else is refused with 401 before it is even looked up.
• One key per account. It acts as you: it sees your tokens, wallets and portfolio, and nobody else's.
• Keep it where only you can reach it. On a server, in an environment variable or a secret manager, or in the protected storage of an app or browser extension installed on your own device. Never put it in a website's code, a URL, a query string or a repository. Ora stores only a hash of it and can't show it to you again.
• No login step, no session. There is nothing to refresh: the key works until you rotate or revoke it, or until API access is turned off on your account.

Anyone who has your key can act on your account, including trading and launching with your wallets. Treat it like a password: only give it to software you trust and that Ora has approved (Building for other people).

The API Key window

In the app, click your profile picture at the top right, then API Key. The window shows:

• your key, with an Active or Inactive badge that tells you whether API access is on. Once you close the window, the key is only shown masked;
• the Generate key button, or Generate new key if you already have one;
• the Base URL to call, with a copy button.

If API access isn't on, the window says so instead of showing the button: contact Ora support to turn it on.

Managing your key

To	Do	Effect
Create	API Key window → Generate key	Shown once. Copy it now.
Rotate	API Key window → Generate new key	The old key is refused from its next call. Update your scripts first.
Revoke	POST /me/api-key/revoke, or ask Ora support	Every call with the key is refused from then on.
Check access	API Key window, or GET /auth/me	Shows whether API access is on and whether a key exists.

If a key leaks, rotate it at once: the leaked one stops working on its next use. API access is also an account-level switch that Ora support can turn off, which blocks every key on the account immediately.

Building for other people

Bots, dashboards, platforms and extensions you build for yourself only need your own key. To offer your software to other Ora users, you first need Ora's written agreement: write to contact@useora.xyz with what it does and how it handles keys. Then:

• each user signs in to your software with their own key, and can revoke it at any time;
• you store the keys you receive as safely as your own, use them only for what each user asked for, and delete them when a user leaves;
• you say clearly that your software is not run by Ora, and you never ask anyone for a recovery key, a private key or a sign-in code.

The full rules are in section 10.11 of the Terms of Service.