Authentication

Authentication

0ct uses API keys to authenticate requests. This guide covers how to create, manage, and use API keys for accessing the 0ct API.

Creating an API Key

1. Log in to your 0ct dashboard
2. Navigate to Settings → API Keys
3. Click Generate New Key
4. Give your key a descriptive name (e.g., “Production Server” or “CI/CD Pipeline”)
5. Copy the key immediately—it won’t be shown again!

Using Your API Key

SDK Authentication

The recommended way to authenticate is using the 0ct SDK:

import Oct from '0ct';

const client = new Oct({
  apiKey: process.env.OCT_API_KEY
});

Direct API Authentication

For direct HTTP requests, include your API key in the Authorization header:

curl https://0ct.com/api/promptly/tasks \
  -H "Authorization: Bearer your-api-key-here"

Environment Variables

We strongly recommend storing your API key in environment variables rather than hardcoding:

# .env file
OCT_API_KEY=sk_live_xxxxxxxxxxxxx

// Your code
const client = new Oct({
  apiKey: process.env.OCT_API_KEY
});

API Key Scopes

API keys in 0ct are scoped to your organization. A single key provides access to all resources within that organization:

• Tasks (create, read, update, delete, run)
• Sources (create, read, update, delete)
• Skills (create, read, update, delete)
• Destinations (create, read, update, delete)
• Runs (read)
• Usage statistics (read)

Security Best Practices

Do

✅ Store API keys in environment variables
✅ Use different keys for development and production
✅ Rotate keys periodically
✅ Revoke unused keys immediately
✅ Use secrets managers in production (AWS Secrets Manager, HashiCorp Vault, etc.)

Don’t

❌ Commit API keys to version control
❌ Share keys between team members (each person should have their own)
❌ Include keys in client-side code
❌ Log API keys in application logs
❌ Send keys over unencrypted channels

Key Rotation

To rotate an API key:

1. Generate a new key in Settings → API Keys
2. Update your application to use the new key
3. Verify the new key works in production
4. Revoke the old key

Rate Limits

API requests are rate-limited to ensure fair usage:

Plan	Requests per minute
Free	60
Pro	300
Enterprise	Custom

Rate limit headers are included in every response:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 299
X-RateLimit-Reset: 1706745600

Error Handling

Authentication errors return a 401 Unauthorized response:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key"
  }
}

Common causes:

• Missing Authorization header
• Invalid API key format
• Revoked or expired key
• Key from a different organization

SDK Error Handling

The SDK throws typed errors for authentication issues:

import Oct, { AuthenticationError } from '0ct';

const client = new Oct({
  apiKey: process.env.OCT_API_KEY
});

try {
  const tasks = await client.promptly.tasks.list();
} catch (error) {
  if (error instanceof AuthenticationError) {
    console.error('Invalid API key');
    // Handle authentication error
  }
  throw error;
}

Next Steps

With authentication set up, you’re ready to:

• Create your first task
• Connect data sources
• Explore the API reference