Authorization header:
- Create keys in the dashboard. Sign in at
app.otbstudio.aiwith a confirmed email address, name the key, and copy it. It is shown once and stored only as a hash: a lost key cannot be recovered, so create another. - A key belongs to your organisation. Every call it makes reads and spends within that organisation. No parameter can point it at another.
- Unlimited keys. Give production, staging and each customer integration its own key, so each has its own usage line in the dashboard. A key costs nothing to hold; calls spend credits.
- Revoking is immediate. A revoked key fails on its next call.
- No login flow. An unattended job or agent needs no browser, only the key. In Claude, the connector signs in with OAuth instead, and reaches the same data with the same organisation’s credits.
- Server-side only. Never put a key in a browser or a mobile app, where anyone can read it. Call the API from your server.
https://api.otbstudio.ai.