Authentication

Secure API access using API keys or OAuth bearer tokens.

Public API Authentication

Most Om API routes require authentication. The canonical external SDK and script path is x-api-key, and the gateway also supports Authorization: Bearer <OAuth access token> for user-scoped OAuth callers. The public exception is GET /v2/health, which is useful for unauthenticated smoke checks.

API key headerBash
curl https://api.omtx.ai/v2/datasets/catalog \
  -H "x-api-key: YOUR_API_KEY_HERE"
OAuth bearer headerBash
curl https://api.omtx.ai/v2/datasets/catalog \
  -H "Authorization: Bearer YOUR_OAUTH_ACCESS_TOKEN"
Public health checkBash
curl https://api.omtx.ai/v2/health

Best practices

  • Keep API keys and bearer tokens in environment variables or a secrets manager.
  • Rotate keys regularly and revoke unused ones.
  • Use API keys for external SDKs/scripts and OAuth bearer tokens for user-scoped interactive integrations.