Authentication
API keys, headers, and rate limits.
API key header
Every programmatic request must include:
X-ORKID-API-Key: <40-char-hex-key>API keys are 40-character hex strings. Only a SHA-256 hash is stored on Orkid's side, so the plaintext key is shown once when it is created.
Getting a key
To create or rotate a key:
- Log in to the Orkid board admin with a master account.
- Open the API Accounts section.
- Generate a key for the partner account.
Or contact api@orkidlabs.com.
Rate limits
| Environment | Tier | Requests / minute |
|---|---|---|
| Production | free | 60 |
| Production | pro | 120 |
| Production | enterprise | 1000 |
| Sandbox | pilot | 300 |
Sandbox keys
Sandbox keys are separate from production keys. A production key will not work on the sandbox and vice versa. See Sandbox environment.
Browser requests
Browser-based requests (e.g. from a frontend widget) are handled differently — the Next.js middleware issues short-lived orkid_quote_token cookies. If you're building a browser integration, use the white-label widget or contact us for a browser token.