Authentication
One bearer token per request, in the standard Authorization header. Keys are tied to an organization, scoped to a workspace, and can carry a hard monthly spend cap.
The Authorization header
Authorization: Bearer sk-t0-<public_id>-<secret>
Same shape as OpenAI — any OpenAI-compatible SDK will set this correctly when you supply api_key.
Mint a key
- Sign in at app.ollima.com via magic link.
- Open Keys → Create key.
- Set a label (you'll thank yourself in 3 months), pick a monthly spend cap, copy the
sk-t0-…value once.
We never show the plaintext key again. Lost it? Revoke + mint a new one. We store only a salted hash; recovery is intentionally impossible.
Revoke a key
From the Keys page, click Revoke. The key fails-closed immediately on subsequent requests (we don't soft-deprecate). Existing in-flight requests complete unmolested.
Org & workspace
Every key belongs to one organization and one workspace (think project). The dashboard surfaces usage rolled up by both. Workspaces are most useful for separating dev / staging / prod billing.
Key handling rules
- Keep keys server-side. Never ship them in browser-side JS or mobile app binaries.
- Use environment variables; commit
.env.examplenot.env. - Set a monthly cap on every key, even your own laptop key. Especially your own laptop key.
- For SaaS where end-users make calls, attribute with
X-Titlerather than handing out per-user Ollima keys — see App attribution.