API Keys

API keys let backend services, CI/CD pipelines, and automations access your workspace without using a personal OAuth token. Keys are scoped to a workspace and can be revoked at any time.

Creating a key

Go to Settings → Developer → API Keys and click Add key. Give the key a description so you can tell them apart later. The secret is shown once — copy it immediately and store it in your secrets manager or environment configuration.

Using a key

Pass the key as a bearer token in the Authorization header:

Authorization: Bearer <your-api-key>

In all API calls, pass workspaceId=current. The API resolves the workspace from the key — you never need to hardcode a workspace ID.

ONE_API_KEY=<your-api-key>
curl https://onehorizon.ai/api/v1/workspaces/current/tasks \  -H "Authorization: Bearer $ONE_API_KEY"

The JavaScript SDK accepts the key directly:

import { Configuration, TasksApi } from '@onehorizon/sdk-js'
const config = new Configuration({ accessToken: process.env.ONE_API_KEY })const tasks = new TasksApi(config)

Permissions

Only workspace owners and admins can create or revoke API keys. A workspace can have up to 20 active keys.

API keys have workspace-level read and write access. They cannot create or revoke other API keys — that requires an OAuth token from an owner or admin.

Rate limits

API key requests share a rate limit per workspace. The default quota is 200 requests per 15 minutes with a burst cap of 40 per minute. All keys in the same workspace draw from the same quota.

When you exceed the limit, the API returns 429 with a message that includes the retry delay:

{ "code": 429, "message": "standard rate limit exceeded, retry in 43 seconds" }

Back off and retry with exponential delay.

Revoking a key

From Settings → Developer → API Keys, click the key and select Revoke. Revocation takes effect immediately.