Skip to main content
Send your API key in the Authorization header of every request:
A key is the text orbbit_data_ followed by 64 letters and digits. Keep it secret: anyone holding it can call the API as you. An agent with its own crypto wallet can instead call without a key and pay per call in USDC. See Pay With x402.

​
Your Default key

Every new account comes with one key already made, named Default. It can call every endpoint, including ones added later, and may spend up to $5 a month. To copy it, open API Keys, find Default, and click Reveal Secret. Unlike other keys, you can reveal it again at any time. Use it to try the API. For anything that runs unattended, create a key of its own with only the scopes it needs.

​
Create a key

  1. Sign in to the Orbbit console and open API Keys.
  2. Click New Key.
  3. Under Name, give the key a name you’ll recognize later, such as cost-dashboard-prod.
  4. Under Spend budget (USD), set the most this key may spend in a month. Once it has spent that much, its calls are refused with 402 until the next calendar month starts (in UTC), even if your balance has money left.
  5. Under Scope, tick the endpoints the key may call. A key can only call the endpoints you tick.
  6. Click Create, then copy the key from the Save your key window.
The console shows the full key only once. Orbbit stores a one-way fingerprint of it, not the key itself, so nobody, including Orbbit, can show it to you again. If you lose it, revoke it and create a new one.
The key list shows the last four characters of each key so you can tell them apart.

​
Choose what a key may call

Each endpoint needs its own permission, called a scope. Give each key only the scopes it needs: a leaked key that can only search branded foods can do far less harm than one that can call everything. The console labels each scope in plain words. For example, get-commodity-prices shows as Get Commodity Metric Values. You can change a key’s name, budget, and scopes at any time from API Keys. The key itself stays the same.

​
When a key is refused

403 Missing scope
See Errors for every error the API returns.

​
Revoke a key

Open API Keys, find the key by its name and last four characters, and click Revoke. Requests using it are refused with 401 straight away. Revoking cannot be undone.

​
Keep keys safe

  • Call the API from your server, never from a browser or mobile app, where anyone can read the key.
  • Store keys in a secrets manager or environment variable, not in source code.
  • Use a separate key for each app and environment, so you can revoke one without breaking the others.