Authentication

Every request is authenticated with a secret API key sent as a bearer token.

API keys

Create keys in Dashboard → Developers. A key looks like orior_live_ followed by 40 letters and digits. The full key is shown once when created; afterwards only its prefix and last four characters are displayed. Orior stores only a hash, so a lost key cannot be recovered — revoke it and create a new one.

Sending the key

curl https://api.oriorai.com/v1/account \
  -H "Authorization: Bearer orior_live_AbC1…"

Missing, malformed, unknown and revoked keys all return 401 UNAUTHORIZED. Revocation takes effect on the next request.

Scopes

New keys have every scope. When the dashboard lets you narrow a key, a request outside its scopes returns 403 SCOPE_REQUIRED.

Monthly credit limits

Give a key a monthly credit limit when you create it. A request that would take the key over its limit in the current calendar month (UTC) fails with 402 SPEND_CAP_REACHED before anything is charged; refunds count back towards the limit. Keys without a limit can spend the whole balance.

Plans and teams

• The API needs an active Influencer or Agency plan (paid or gifted). The plan is checked on every request: if it lapses, requests return 403 PLAN_REQUIRED until it is active again.
• For team members the team owner is the paying account — its plan, limits and credits apply, and GET /account reports team_billing: true. Resources (characters, generations, posts) belong to the member who created them.
• Suspended accounts receive 403 ACCOUNT_SUSPENDED.

Keeping keys safe

• Call the API from your server only. Never put keys in browser code, mobile apps, or repositories.
• Use one key per environment and service so you can revoke one without affecting others.
• Rotate by creating a new key, deploying it, then revoking the old one.
• If a key leaks, revoke it immediately in the dashboard. Charges made before revocation stand.