Authentication
Every request carries an access key and a secret key.
Overview
Every request is signed in with an API key instead of a person's login. The key decides which company the request belongs to and what it may do.
A key is a pair
| Part | Looks like | What it is |
|---|---|---|
| Access key | Starts with o2m_ak_ | Identifies the key. It is shown on the API keys page. |
| Secret key | Starts with o2m_live_ | Proves the request is yours. It is hidden on the page; click the eye beside it to see it again. |
A request needs both, and they must belong to the same key.
Important Treat the secret key like a password. Use it only from your server, never in a web page, a mobile app or source control. Revoke the key at once if it may have been shared.
Send the key
Two headers (recommended)
curl "https://api.o2m.in/api/v1/warehouses" \
-H "X-Access-Key: $O2M_ACCESS_KEY" \
-H "X-Secret-Key: $O2M_SECRET_KEY"HTTP Basic
For tools that offer a user name and password. The access key is the user name and the secret key is the password.
curl "https://api.o2m.in/api/v1/warehouses" -u "$O2M_ACCESS_KEY:$O2M_SECRET_KEY"Bearer token
The secret key as a bearer token. The access key still goes in its own header.
curl "https://api.o2m.in/api/v1/warehouses" \
-H "X-Access-Key: $O2M_ACCESS_KEY" \
-H "Authorization: Bearer $O2M_SECRET_KEY"Errors
| Status | Code | Message | What to do |
|---|---|---|---|
| 401 | NO_API_KEY | Send your access key in the X-Access-Key header and your secret key in the X-Secret-Key header | Add the secret key to the request. |
| 401 | NO_ACCESS_KEY | Send your access key in the X-Access-Key header, beside the secret key. It is shown in Settings → API keys. | Add the access key to the request. |
| 401 | INVALID_API_KEY | This access key and secret key are not valid together, or the key was revoked or has expired | Check both values, then see the reasons below. |
| 403 | COMPANY_INACTIVE | Company account is suspended or terminated | Contact your O2M account manager. |
| 403 | MODULE_NOT_ENABLED | The public API is not enabled for your company by the platform administrator | Ask your O2M account manager to enable it. |
Why a key stops working
A key that worked before answers 401 INVALID_API_KEY in any of these cases:
- It was revoked, or its expiry date has passed.
- The person who made it was disabled or removed from the company.
- The person who made it no longer has one of the permissions the key carries.
A key acts for the person who made it. Make keys for live systems from an account that will stay, such as an admin's, and replace a key before its maker leaves.
Good to know After a key is revoked, it can keep working for up to half a minute.