Every call except /v1/health and /v1/buckets needs your API key.

​
Send the key in a header

X-API-Key: orl_… works too, if your tool cannot set Authorization.
Keys start with orl_ followed by 32 characters. Keys made before the service was renamed Orelys start with fly_: they keep working as they are, and there is no need to regenerate them.
Never put the key in the URL. A call like /v1/me?key=orl_… is refused with 400 key_in_url, and the key is revoked on the spot (key_revoked: true in the answer): URLs end up in logs, browser history and proxies. Create a new key and send it in a header.

​
Manage your key

You manage your key on orelys.io/account/api, signed in to your Orelys account. You have one key at a time. It is stored encrypted, so the page can show it to you again, with your password. If the page shows only the start of your key, regenerate it to get a new one you can see in full. Changing your account password revokes the key: create a new one afterwards.

​
Regenerate a leaked key

If your key may have leaked — pushed to a repository, pasted in a chat, sent in a URL — click Regenerate on orelys.io/account/api. The old key stops working the moment the new one is created. Then update the key wherever you use it.

​
Keep it private

  • Your key is personal, like a password. Do not share it.
  • Keep it on a server or in your own scripts, in an environment variable or a secret manager, not in your source code.
  • Do not put it in a web page or an app other people use. Anyone who can read the page can read the key. The API does not answer browsers from other sites for that reason; call it from your backend.

​
When the plan ends

The key belongs to your account, but API access belongs to the plan. When your account leaves Professional or Enterprise — for example when a plan ends after its 30 days — every call answers 403 plan_required. Your key is kept, and works again as soon as the account is back on one of these plans.

​
Authentication errors