oorr / api platform
.open {API}

DEVELOPER PLATFORM10 — API Keys

API Keys UI only

OORR API Platform Sargon 1.5

Key management is not implemented — nothing here issues a real key

The deployed OORR backend has no key store, no key generation, no bearer validation and no revocation. The dashboard below is a non-functional interface shell: its Create API key button is disabled and it lists no keys, because a working key cannot be produced from this page. A page that appeared to mint a key would be issuing a credential that authenticates nothing.

Your API keys

Awaiting backend

Requires POST /api/keys and GET /api/keys.

No keys — and none can be created until key management ships. The row above shows the intended layout, not an existing key.

Intended key handling Pending

These are the rules the implementation is specified to follow:

  • Shown once. The full secret is returned only in the response that creates it, and is never retrievable again.
  • Stored hashed. Only a hash is persisted, matching how the existing service already stores session tokens and one-time codes.
  • Masked thereafter. Listings return a prefix and last four characters only — enough to tell keys apart, never enough to use one.
  • Renameable, revocable. A label can change freely; revocation is immediate and irreversible, and a revoked key is rejected before the request is served.
  • Attributable. Rate limits, daily allowances and usage rows key off the API key instead of a self-declared userId.

The "Copy" action is only meaningful at creation time, when the plaintext secret is briefly in hand. For an already-listed key there is nothing to copy but the mask — which is why it is disabled here rather than silently copying a useless string.

Planned create response

Planned — endpoint does not exist
POST /api/keys
{ "name": "production-server" }

201 Created
{
  "id":        "key_9f2c1a",
  "name":      "production-server",
  "key":       "oorr_sk_live_7Qd2...8xKf",   // shown exactly once
  "prefix":    "oorr_sk_live",
  "last4":     "8xKf",
  "createdAt": "2026-09-23T09:14:02.441Z"
}

Planned list response

Planned — endpoint does not exist
GET /api/keys

200 OK
{
  "keys": [
    {
      "id":         "key_9f2c1a",
      "name":       "production-server",
      "masked":     "oorr_sk_live_••••8xKf",
      "createdAt":  "2026-09-23T09:14:02.441Z",
      "lastUsedAt": "2026-09-23T11:02:55.108Z",
      "revokedAt":  null
    }
  ]
}

Until then

Call the live endpoints documented above without an Authorization header, supplying your own userId. Contact Radiant if you need the key layer prioritised for an integration.