API reference
API keys.
Created once, kept safe.
Every request needs an API key. A key can do anything its creator can do in that workspace, so keep it on your server, never in a web page or an app.
Create a key
Use your key
Add your key to the Authorization header of every request:
Request headers
Authorization: Bearer sk-…Content-Type: application/jsonRead the key from an environment variable instead of writing it into your code:
curl -X POST "https://api.ollive.ai/api/deployments/query/v1" \ -H "Authorization: Bearer $OLLIVE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "status": "active", "limit": 10 }'import osimport requests response = requests.post( "https://api.ollive.ai/api/deployments/query/v1", headers={"Authorization": f"Bearer {os.environ['OLLIVE_API_KEY']}"}, json={ "status": "active", "limit": 10 }, timeout=30,)response.raise_for_status()print(response.json())const response = await fetch("https://api.ollive.ai/api/deployments/query/v1", { method: 'POST', headers: { Authorization: `Bearer ${process.env.OLLIVE_API_KEY}`, 'Content-Type': 'application/json', }, body: JSON.stringify({ "status": "active", "limit": 10 }),}); if (!response.ok) throw new Error(`Ollive API ${response.status}`);const data = await response.json();About keys
| What it looks like | A long string that starts with sk-. |
|---|---|
| When you see it | Only once, when you create it. If you lose it, revoke it and create a new one. |
| What it can do | Anything you can do in that workspace. |
| How long it lasts | 90 days by default. You can choose 30 days, 180 days or 1 year instead. |
| How many you can have | Up to 10 active keys per person in each workspace. |
Replace a key
Switch to a new key before you revoke the old one, so your integration keeps working throughout.
- Create a new key
Give it a name you can tell apart from the old one, such as Production backend (October).
- Switch to it
Update the key wherever the old one is used, and check that a request with the new key works.
- Revoke the old key
On the API keys page, choose Revoke. The old key stops working right away. This can’t be undone.
When authentication fails
| Error | What it means |
|---|---|
401not_authenticated | The request has no API key. |
401authentication_failed | The API key is wrong, revoked or expired. |
403permission_denied | This API key doesn’t have access. Contact support. |
Example response
{ "error": { "code": "authentication_failed", "message": "Invalid API key.", "param": "", "request_id": "4b1f0c9e2d7a48b6a3e5f19c0d8b7a26" }}Keep keys safe
- Store keys on your server, in an environment variable or a secret manager. Never put one in a web page, a mobile app or a code repository.
- Use a separate key for each service, so you can revoke one without affecting the others.
- If a key might have been exposed, revoke it and create a new one straight away.
- Never share a key with support. Send the
X-Request-Idfrom the response instead.