Skip to content
OIDOT

API keys

Machine credentials that aren't a shared password.

Scoped, rotatable API keys for programmatic access — built for the code calling your integration, not the person clicking through a dashboard.

Credentials scoped to the job, not the account

A password authenticates a person; an API key authenticates a script or service, and the two shouldn't be interchangeable. Oidot's API keys are scoped to exactly the permissions an integration needs, so a compromised key exposes less than a compromised password would.

Keys can be rotated without downtime — issue a new one, update the integration, revoke the old one — rather than requiring a coordinated password change across every consumer of a shared credential.

Features

Scoped to specific permissions

An API key carries exactly the access its integration needs, not full account access.

Rotatable without downtime

Issue a new key, migrate the integration, then revoke the old one on your own schedule.

Rate limited

Predictable limits per key, so one runaway integration doesn't affect every other caller.

Usage is auditable

Key activity is logged the same way admin actions are — nothing programmatic is invisible.

API key authentication flowA request authenticated with an API key is checked against that key's own scope, not the account's full permissions.presentswithin scopeIntegrationAPI keyScope checkEndpoint
data-flow diagram: A request authenticated with an API key is checked against that key's own scope, not the account's full permissions.

Start integrating

Generate a scoped key and make your first authenticated request.