Authentication

Every request needs an API key. There is no anonymous access, not even to ping.

Sending the key

Either header works. They are equivalent — pick one and be consistent:

# Preferred
curl … -H "Authorization: Bearer of_live_xxxxxxxx"

# Alternative
curl … -H "apikey: of_live_xxxxxxxx"

Key shape

of_live_7CwSJoR3f2…      of_test_KKhJM5pQ1z…
│  │    └─ random token (base62, 32 bytes of entropy)
│  └────── environment: live or test
└───────── namespace, always gw

The prefix is not decoration. It is what the edge routes on: an of_test_ key is sent to the sandbox and an of_live_ key to the live service, before any authentication happens. See Sandbox and live.

What happens to your key

Only an HMAC of the key is ever stored — not the key itself. That means:

• The full key is shown exactly once, when you create it.
• Nobody, including us, can read it back to you afterwards.
• A lost key is replaced, not recovered.

Keys are checked on every single request: the signature, whether the key is revoked or expired, whether you are within your per-minute rate limit, and whether you are within your monthly quota. A failure at any of these stops the request at the edge — the document service never sees it.

Rotating a key

1. Create the new key in the portal.
2. Deploy it.
3. Revoke the old one.

Revocation takes effect on the next request; there is no cache to wait out.

Keeping it secret

A live key is a bearer credential — anyone holding it can spend your quota. Keep it server-side, out of git, and out of anything that ships to a browser.

Test keys are different in kind, not just in limit: they cannot reach live document processing at all, so pasting one into the playground on this site (or a client-side sample) is fine and intended.