Authentication & API keys

Orion uses two credential types:

• API keys authenticate every data request, sent in the x-orion-token header. This is what you use to read positions, activities, and protocol data.
• Bearer tokens (JWT) authenticate organization-management requests — reading your org, listing keys, revoking keys. These requests are not open yet; see Bearer tokens.

Data endpoints never accept a bearer token, and management endpoints never accept an API key.

API keys

Send your key on every data request:

curl https://mainnet.g.orionhq.run/v1/users/GCHAIE7BKB2EWTPQG2RWI3IQIALHUKP2LPAZZFG3STLXRUD37PZ7WEUZ/positions \
  -H "x-orion-token: sk-orion-...your-key..."

A key value is shown exactly once, at creation. Orion stores only a hash — listing keys returns their metadata and prefix, never the full secret. If you lose a key, revoke it and mint a new one.

Manage keys

Keys are created, listed and revoked in the developer console. A revoked key is refused on every subsequent request.

Bearer tokens

Management endpoints (GET /v1/org, listing and revoking keys) authenticate with a JWT access token in the authorization header.

There is no login route and no token route. You don’t exchange a password for a credential: you create your account and your API keys in the developer console, and send a key on every data request in the x-orion-token header:

curl https://mainnet.g.orionhq.run/v1/users/GCHAIE7BKB2EWTPQG2RWI3IQIALHUKP2LPAZZFG3STLXRUD37PZ7WEUZ/positions \
  -H "x-orion-token: <key>"

A data request without a valid key returns 401, and the error message points to the developer console.

The organization-management requests are not open yet: they return 400 with a “launching soon” message. Until they are, manage your keys in the developer console.

Errors

Authentication failures return the standard error envelope:

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key"
  },
  "meta": { "...": "response metadata" }
}

Every organization gets 60 requests a minute, shared across all of its API keys. If you need more than that, book a call with the Orion team.