Skip to main content
All requests to the Orafi API must include a valid API key in the x-api-key header. Your API key identifies your business and determines whether requests run in test or live mode.

​
API key format

Both test and live keys are 32+ characters and available in your Dashboard.

​
Making authenticated requests

Include your API key in the x-api-key header on every request:
Requests without a valid x-api-key header return a 401 Unauthorized error.

​
Test vs live mode

Your API key controls which mode you operate in. Both modes use the same base URL (https://api.orafi.app), so there’s no environment-specific endpoint to remember.
Always develop and test your integration using test-mode keys first. Switch to live keys only after your integration is verified.

​
Keeping keys secure

  • Never expose API keys in client-side code, mobile apps, or public repositories.
  • Store keys in environment variables or a secrets manager.
  • Rotate keys immediately if you suspect they have been compromised.
  • Use test keys for all development and CI/CD pipelines.