Authentication

The Orbit API supports two authentication methods: API keys for server-to-server

calls and OAuth 2.0 for user-delegated access.

API keys

Send your key in the `Authorization` header as a bearer token:

Authorization: Bearer sk_live_xxx

Keys are scoped to a single project. Rotate a key from the dashboard; the old key

stays valid for 24 hours after rotation.

OAuth 2.0

Use the authorization code flow for actions taken on behalf of a user. Exchange

the code at `POST /oauth/token`. Access tokens expire after 1 hour; refresh tokens

last 30 days.

Rules for agents

• Never log or echo a bearer token.
• Treat a 401 as "reauthenticate", not "retry with the same token".
• API keys are project-scoped; do not assume a key works across projects.