Authentication

The OrbitForms API uses API keys to authenticate requests. You can manage your API keys from your dashboard.

API Keys

There are two types of API keys: sk_live_* — Live keys for production use. All requests affect real data. sk_test_* — Test keys for development and testing, so you can distinguish non-production credentials in your dashboard.

Using API Keys

Include your API key using either the Authorization header as a Bearer token, or the X-API-Key header:

Authorization: Bearer sk_live_your_api_key_here

# Or use the X-API-Key header:
X-API-Key: sk_live_your_api_key_here

Example request:

curl -X GET "https://app.useorbitcrm.ai/api/v1/forms" \
  -H "Authorization: Bearer sk_live_your_api_key_here" \
  -H "Content-Type: application/json"

# Alternative with X-API-Key header:
curl -X GET "https://app.useorbitcrm.ai/api/v1/forms" \
  -H "X-API-Key: sk_live_your_api_key_here" \
  -H "Content-Type: application/json"

OAuth 2.0

Third-party applications use the OAuth 2.0 authorization code flow (guide). An app registered in the Developer Portal is a confidential client and authenticates token requests with its client_secret; a public client (one without a secret, such as a self-registered MCP client) uses PKCE instead. OAuth access tokens use the orb_at_* prefix.

To build an OAuth app, open a free developer account in the Developer Portal to register your application and obtain client credentials.

Who am I

GET /api/v1/me describes the credential making the request: the workspace it is bound to, the person it acts as, and its scopes. It needs team:read or user:read; ids are always returned, the workspace’s name and slug need team:read, the person’s email and name need user:read.

curl https://app.useorbitcrm.ai/api/v1/me \
  -H "Authorization: Bearer YOUR_TOKEN"

{
  "data": {
    "team": { "id": "7c1d0e2f-...", "name": "Acme", "slug": "acme" },
    "user": { "id": "d4e5f6a7-...", "email": "sam@acme.com", "name": "Sam Rivera" },
    "credential": {
      "type": "oauth",
      "scopes": ["deals:read", "webhooks:write", "team:read", "user:read"],
      "app": { "id": "79d87982-...", "client_id": "orb_client_...", "name": "Your app" }
    }
  }
}

team.id is the team_id on every record and webhook envelope. OAuth token responses also carry it as team_id, so an app can tell its connections apart before its first API call. credential.app.id is the actor.app_id that webhooks carry for changes your app made (Changes your app made).

Security Best Practices

Keep keys secret — Never expose API keys in client-side code, public repositories, or browser localStorage/sessionStorage.

Use environment variables — Store API keys in environment variables on your server. Never include them in frontend bundles.

Rotate compromised keys — If a key is exposed, revoke it immediately from your dashboard and generate a new one.

Authentication Errors

Status	Meaning
`401`	Invalid or missing API key
`403`	API key lacks required permissions

Next: Forms API

Getting Started

API Reference

Webhooks

SDKs & Tools

Developer Resources

API Keys

Using API Keys

OAuth 2.0

Who am I

Security Best Practices

Authentication Errors

​API Keys

​Using API Keys

​OAuth 2.0

​Who am I

​Security Best Practices

​Authentication Errors

API Keys

Using API Keys

OAuth 2.0

Who am I

Security Best Practices

Authentication Errors