Authentication
Secret keys, environments, and keeping keys safe.
Every request to https://api.onari.xyz/v1 needs a secret key:
-H "Authorization: Bearer sk_live_4f2aQx…"| Key | Environment |
|---|---|
sk_test_ + 32 characters | Sandbox |
sk_live_ + 32 characters | Live |
Create keys in Developers → API keys (owners, admins and developers). The full key is shown once; Onari stores only a hash of it.
Keep keys on your server
Secret keys can send events and make Rewards Hub links for any player. Never put them in a mobile app, a web page or a public repository. Your app talks to your server, and your server talks to Onari.
Rolling and revoking
- Roll makes a new key with the same name; the old one keeps working for 24 hours so you can deploy without downtime.
- Revoke stops a key immediately.
A key stops working within a minute of being rolled out or revoked. Requests with a missing, malformed or revoked key get 401 invalid_api_key.