oorr / api platform
.open {API}

DEVELOPER PLATFORM03 — Authentication

Authentication Pending

OORR API Platform Sargon 1.5

API-key authentication is not deployed yet

There is currently no API-key system on the OORR API. The tutor endpoints accept no Authorization header, and no key is issued, validated or revoked anywhere in the deployed service. Anything on this page describing bearer keys is a planned contract, not a live one.

How requests are identified today

The caller supplies its own userId in the request body. That value is what the server uses for rate limiting, daily token allowances and usage accounting — it is not authenticated, and it is not proof of identity.

MechanismWhereProtectsStatus
userId in body/api/tutor*Rate limit, daily allowance, usage rowsLive
Session cookie/api/auth/*Signed-in student accounts (WhatsApp OTP)Live
Authorization: Bearer/api/tutor*Developer API keysPending

The existing account auth is a passwordless WhatsApp one-time-code flow that issues an HttpOnly session cookie. It authenticates students in the OORR app; it is not a developer credential and does not grant API access.

Planned bearer-key contract Pending

When key auth ships, it is intended to look like the following. Do not build against this yet — the header is currently ignored.

Planned — not yet accepted
curl -X POST https://api.oorr.ai/api/tutor \
  -H "Authorization: Bearer $OORR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "message": "اشرح قانون أوم بإيجاز", "modelTier": "basic" }'

Under that design the key identifies the caller, so userId becomes optional and rate limits, allowances and usage attach to the key rather than to a self-declared id.