Authentication

Every request carries a secret API key of the ORYKSA account.

Send the key in the Authorization header as a bearer token (the X-API-Key header also works). Keys start with oryk_live_.

curl https://api.oryksa.com/v1/account \
  -H "Authorization: Bearer oryk_live_YOUR_KEY"

const res = await fetch("https://api.oryksa.com/v1/account", {
  headers: { Authorization: "Bearer " + process.env.ORYKSA_API_KEY },
});

requests.get("https://api.oryksa.com/v1/account",
             headers={"Authorization": f"Bearer {os.environ['ORYKSA_API_KEY']}"})

Managing keys

Create and revoke keys on the API keys page. Up to 10 active keys per account, one per app or environment is a good practice.
The full key is shown once. ORYKSA only stores a SHA-256 hash, so a lost key cannot be recovered: revoke it and create a new one.
A revoked key stops working immediately.

Keep keys on the server. An API key gives access to the account's AI agent, knowledge and conversations. Never ship it inside a website, a mobile app bundle or a public repository. For websites use the chat widget, whose token is public by design.

Base URL and versions

All endpoints live under https://api.oryksa.com/v1 and always return JSON. Responses to errors include the header ORYKSA-Version. Breaking changes will only ever ship under a new version (/v2).