Every request to the ODEN API is authenticated with an API key, sent as a bearer token.
The Authorization header#
Pass your key in the Authorization header on every request:
POST /search HTTP/1.1
Host: api.oden-api.com
Authorization: Bearer oden_live_your_key_here
Content-Type: application/jsonThere is no other auth scheme — no query-string keys, no basic auth, no cookies. A missing, malformed or revoked key returns X0 .
Getting a key#
Sign in at oden-api.com/app and generate a key from the dashboard. Keys are prefixed oden_live_ so they are easy to spot in logs and secret scanners. Every account starts on the free tier with 1,000 searches a month.
Keep keys server-side#
A key can spend your quota, so treat it like a password:
- Never ship a key in client-side code — not in a browser bundle, a mobile app, or a public repo. Anyone who reads it can use it.
- Store it in an environment variable or a secret manager, not in source control. A committed key should be considered burned; rotate it.
- Proxy from your backend if a browser or app needs results. Your server holds the key and calls ODEN; the client calls your server.
# Good: key in the environment, read at runtime
export ODEN_KEY="oden_live_..."Rotating a key#
To rotate, generate a new key in the dashboard, deploy it, then delete the old one. A deleted key stops working immediately, so the safe order is:
- Create the new key.
- Roll it out everywhere the old key was used.
- Delete the old key and confirm nothing 401s.
If a key leaks, delete it first and re-issue after — a leaked key that can still spend quota is worse than a brief outage.
Next steps#
- Make a call: Search endpoint.
- Understand quotas: Rate limits.