> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useorbitcrm.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The OrbitForms API uses API keys to authenticate requests. You can manage your API keys from your dashboard.

The OrbitForms API uses API keys to authenticate requests. You can manage your API keys from your dashboard.

## API Keys

There are two types of API keys:

`sk_live_*` — Live keys for production use. All requests affect real data.

`sk_test_*` — Test keys for development and testing, so you can distinguish non-production credentials in your dashboard.

## Using API Keys

Include your API key using either the `Authorization` header as a Bearer token, or the `X-API-Key` header:

```
Authorization: Bearer sk_live_your_api_key_here

# Or use the X-API-Key header:
X-API-Key: sk_live_your_api_key_here
```

Example request:

```bash theme={null}
curl -X GET "https://app.useorbitcrm.ai/api/v1/forms" \
  -H "Authorization: Bearer sk_live_your_api_key_here" \
  -H "Content-Type: application/json"

# Alternative with X-API-Key header:
curl -X GET "https://app.useorbitcrm.ai/api/v1/forms" \
  -H "X-API-Key: sk_live_your_api_key_here" \
  -H "Content-Type: application/json"
```

## OAuth 2.0

Third-party applications use the OAuth 2.0 authorization code flow ([guide](https://docs.useorbitcrm.ai/apps/oauth.md)). An app registered in the Developer Portal is a confidential client and authenticates token requests with its `client_secret`; a public client (one without a secret, such as a self-registered MCP client) uses PKCE instead. OAuth access tokens use the `orb_at_*` prefix.

> [!NOTE]
>
> To build an OAuth app, open a free developer account in the [Developer Portal](https://app.useorbitcrm.ai/developer-portal) to register your application and obtain client credentials.

## Who am I

`GET /api/v1/me` describes the credential making the request: the workspace it is bound to, the person it acts as, and its scopes. It needs `team:read` or `user:read`; ids are always returned, the workspace's name and slug need `team:read`, the person's email and name need `user:read`.

```bash theme={null}
curl https://app.useorbitcrm.ai/api/v1/me \
  -H "Authorization: Bearer YOUR_TOKEN"
```

```json theme={null}
{
  "data": {
    "team": { "id": "7c1d0e2f-...", "name": "Acme", "slug": "acme" },
    "user": { "id": "d4e5f6a7-...", "email": "sam@acme.com", "name": "Sam Rivera" },
    "credential": {
      "type": "oauth",
      "scopes": ["deals:read", "webhooks:write", "team:read", "user:read"],
      "app": { "id": "79d87982-...", "client_id": "orb_client_...", "name": "Your app" }
    }
  }
}
```

`team.id` is the `team_id` on every record and webhook envelope. OAuth token responses also carry it as `team_id`, so an app can tell its connections apart before its first API call. `credential.app.id` is the `actor.app_id` that webhooks carry for changes your app made ([Changes your app made](https://docs.useorbitcrm.ai/developers/webhooks/overview.md#changes-your-app-made)).

## Security Best Practices

> [!WARNING]
>
> **Keep keys secret** — Never expose API keys in client-side code, public repositories, or browser localStorage/sessionStorage.

> [!NOTE]
>
> **Use environment variables** — Store API keys in environment variables on your server. Never include them in frontend bundles.

> [!WARNING]
>
> **Rotate compromised keys** — If a key is exposed, revoke it immediately from your dashboard and generate a new one.

## Authentication Errors

| Status | Meaning |
| - | - |
| `401` | Invalid or missing API key |
| `403` | API key lacks required permissions |

[Next: Forms API](https://docs.useorbitcrm.ai/developers/api/forms.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.