Authentication

Ontyx accepts two kinds of credential:

OAuth (connector) — for assistants with a connector UI. You sign in through a browser and approve access; no secret is stored in a config file. This is the easier path for Claude, ChatGPT, Grok and similar clients — see Connect your assistant.
API key — a static bearer token for scripts, servers, CI, and any client that lets you set request headers. Documented on this page.

Both resolve to the same account and draw on the same monthly credits.

Terms acceptance

Whichever credential you use, your account must have accepted the current Terms of Service. New accounts accept during sign-up. Existing accounts — and everyone after a material change to the documents — accept once at /legal/accept.

Connector calls from an account without a current acceptance are refused with TERMS_ACCEPTANCE_REQUIRED (HTTP 403) and a link to that page. Accept and retry; you do not need to reconnect.

API keys

The Ontyx HTTP API uses bearer tokens for authentication. Generate a token from the dashboard and send it in the Authorization header on every request.

Authorization: Bearer ontyx_live_ak_<keyId>_<secret>

API keys follow the format ontyx_<env>_ak_<keyId>_<secret>, where:

ontyx identifies the product namespace.
env is live or test. Today only live keys are issued; test is reserved for a future sandbox.
ak is the credential type. Future credential types (for example sk, pk) will use the same shape.
keyId is a 26-character public identifier you can safely share when reporting issues — it lets us find your key without you sending the secret.
secret is a 32-character random component (~190 bits of entropy). This is the part you must keep private.

The ontyx_live_ak_ prefix makes keys easy to identify in logs and secrets scanners.

Generate a key

Sign in to the Ontyx dashboard.
Go to API Keys and click New key.
Give your key a descriptive name — for example, the service or agent that will use it.
Click Create and copy the key immediately.

The plaintext is shown exactly once. The dashboard stores only an Argon2id hash of the secret segment — never the full token — so it cannot be recovered later. If you lose the key, revoke it and create a new one.

Show-once UX

After creation, a panel appears with the full token and a “Copy” button. You must confirm “I have saved this key” before navigating away. Once you dismiss the panel, the plaintext is gone from the UI permanently.

Revoke a key

To revoke a key, go to Dashboard → API Keys, find the key by its public identifier (ontyx_live_ak_<keyId>), and click Revoke. Revocation is immediate — the key is deleted from the store and any subsequent requests using it will return 401 INVALID_KEY.

Revocation is also available via the control plane API:

DELETE /api-keys/:id
Authorization: <session cookie — dashboard use only>

Control plane vs. product API

Ontyx has two distinct API surfaces:

Control plane — The endpoints listed in this documentation (subscription management, API key lifecycle, usage). These are intended for the dashboard and are authenticated with a session cookie issued at sign-in, not an API key. You would not normally call these from your application code.

Product API — The data-serving endpoints accessed by your agent or application code. These use the bearer token mechanism described on this page. [TODO: documented post-MCP-launch]

Do not use session cookies in automated code — use an API key. Do not use API keys to call dashboard/control-plane endpoints — they are not accepted there.

Available Tools Reference