Authentication

API Keys

All API requests require an API key. Generate keys in your dashboard:

Go to app.okrapdf.com/settings
Click Create API Key
Copy the key (starts with okra_)

API keys grant full access to your account. Never expose them in client-side code or public repositories.

Passing your key

Use one of these two methods:

Bearer token (recommended)

curl https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer okra_YOUR_KEY"

curl https://api.okrapdf.com/v1/documents \
  -H "x-api-key: okra_YOUR_KEY"

Security best practices

Store keys in environment variables, not in code
Use different keys for development and production
Rotate keys periodically
Revoke keys immediately if compromised

For route-level access boundaries, see Security Model.

# .env
OKRA_API_KEY=okra_YOUR_KEY

import os
import requests

resp = requests.get(
    "https://api.okrapdf.com/v1/documents",
    headers={"Authorization": f"Bearer {os.environ['OKRA_API_KEY']}"},
)

Error responses

Invalid or missing API keys return a 401 status:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or revoked API key."
  }
}

Introduction Security Model

Overview

Files

Documents

Content

Entities

AI

Exports

Hosting

Conversions

Agents

Workflows

Collections

Filings (Data API)

Companies (Data API)

SDK & React

API Keys

Passing your key

Bearer token (recommended)

Header

Security best practices

Error responses

​API Keys

​Passing your key

​Bearer token (recommended)

​Header

​Security best practices

​Error responses

API Keys

Passing your key

Bearer token (recommended)

Header

Security best practices

Error responses