Skip to main content
The OlivIA API authenticates with a personal API key sent as a bearer token on every request:

​
Getting a key

API keys are issued from the platform by an administrator in your organization (there is no self-serve key endpoint). Each key is bound to a user and an organization and inherits that user’s role: tenancy (org_id) and permissions are derived from the key, so you never send an organization identifier.
The key is shown only once, at creation. Store it in a secrets manager; OlivIA keeps only a hash and cannot recover it. If it is compromised, revoke it and issue a new one.

​
Roles and permissions

Each endpoint requires a minimum role. The key’s effective role is the owning user’s role. If a key lacks the required role, the API returns 403.

​
Best practices

  • Use a separate key per integration or environment so it can be revoked in isolation.
  • Never embed the key in front-end clients or in repositories.
  • Rotate keys periodically.