Skip to main content
All Operark API requests authenticate with a Bearer token in the Authorization header:
Requests without a valid credential receive 401 Unauthorized. Requests for a resource outside your organization receive 403 ORGANIZATION_MISMATCH — never a silent empty result.

​
Credential types

API keys are scoped to a single organization. The organization is always derived from the key server-side — it is never read from the URL or request body. This is what makes cross-tenant access impossible by construction.

​
Creating and rotating keys

  1. In the dashboard, open Settings → API Keys.
  2. Create a key, give it a name, and copy it — the full value is shown once.
  3. To rotate, create a new key, deploy it, then revoke the old one.
Store keys in a secret manager or environment variables. Never embed an API key in frontend code or a public repository.

​
Errors

Operark uses conventional HTTP status codes and a consistent error envelope:

​
Rate limits

Auth and public endpoints are rate limited per organization. When you exceed a limit you receive 429; respect the Retry-After header where present.