Authentication

Every request to /api/public/v1/* must include an API key as an HTTP Bearer token. There is no X-Api-Key header.

Key format

Keys look like onn_live_<48 hex characters> — a public prefix and an opaque secret. Lookup uses the first 12 characters; the secret is hashed with argon2id and is never stored in plaintext.

Sending the key

Pass the key in the Authorization header using the Bearer scheme:

Authorization: Bearer onn_live_a1b2c3d4...

Base URL:

https://api.onnie.ai/api/public/v1

Scopes

v1 keys carry only:

• tables:read — catalog, schema, list/get records, FILE sign
• tables:write — create/patch/delete records, FILE presign and register

tables:write implies tables:read. A write key may call every Data API route. Missing scope → 403 scope.denied.

Key lifecycle

• Keys can be revoked at any time from workspace settings — revoked keys stop working immediately (401 auth.invalid, same as a bad token).
• Workspace admins are the only members who can create or revoke keys.
• If Database is disabled for the workspace, a valid key still receives 403 database.disabled on every Data route. Keys are not auto-revoked.