Authentication

The API authenticates with bearer keys. A key looks like osk_ followed by a long random string, and it is tied to your account and your plan: if your Developer plan is active the key works, if the plan lapses the key answers 403 until you renew. No key rotation is required around renewals.

Creating and managing keys

Keys live in Settings → Developer → Configure. You can hold several keys at once; one per project or environment is the pattern we recommend, because each key has its own usage counters and can be revoked independently. The full key value is displayed once, at creation. We store only a hash, so a lost key cannot be recovered; revoke it and mint a new one.

The settings page also shows a per-key usage dashboard: requests today, requests this month and the last-used timestamp. It is useful both for tracking your own consumption against the daily quota and for spotting a leaked key (a key you retired that suddenly shows traffic).

Sending the key

Two equivalent header forms are accepted on every endpoint. Use whichever your HTTP client makes easier; Authorization: Bearer is the conventional choice.

Authorization: Bearer osk_YOUR_KEY
# or
X-API-Key: osk_YOUR_KEY

curl "https://osiristrader.com/api/v1/symbols" \
  -H "Authorization: Bearer osk_YOUR_KEY"

const res = await fetch("https://osiristrader.com/api/v1/symbols", {
    headers: { Authorization: "Bearer " + process.env.OSIRIS_KEY },
});
const { data } = await res.json();

import os, requests

res = requests.get(
    "https://osiristrader.com/api/v1/symbols",
    headers={"Authorization": f"Bearer {os.environ['OSIRIS_KEY']}"},
    timeout=10,
)
data = res.json()["data"]

Auth failures

Keeping keys safe

• Treat a key like a password: environment variables or a secrets manager, never source control. A key committed to a public repo should be considered burned: revoke it.
• Never ship a key in browser or mobile code. Anything delivered to a client device is public. Put the key on your server and proxy the calls your frontend needs.
• Use separate keys per environment (dev, staging, production). Revoking a compromised staging key then costs you nothing in production.
• Rotate on team changes. Since multiple keys can be active at once, rotation is zero-downtime: create the new key, deploy it, revoke the old one.