Authenticate v3 API requests

Every v3 request requires a developer API key in the Authorization header:

curl "https://api.orbitsearch.com/v3/search/$SEARCH_ID" \
  -H "Authorization: Bearer sk_orb_REDACTED"

Create and manage keys in the Orbit developer dashboard. The raw sk_orb_... value appears only once, so store it in a secrets manager immediately.

Scopes

Scope	Grants
`search:read`	Start and poll Search; start and poll Enrich.
`profile:read`	Embed profiles in Search or Enrich responses and read an enriched profile.

Most integrations should create a key with both scopes. A Search or Enrich request with include_profile: false only needs search:read; profile work still occurs, but the response does not embed profile data.

Key lifecycle

Issue

Create a key with the minimum scopes your integration needs and copy the raw value.

Use

Send it as Authorization: Bearer sk_orb_.... Do not put keys in URLs, client-side code, or logs.

Rotate

Create a replacement, move callers gradually, and verify its last_used_at value before retiring the old key.

Revoke

Revoke the old key in the dashboard. Revocation preserves metadata for audits while immediately rejecting new requests.

Authentication errors

Status	Code	Meaning
`401`	`missing_api_key`	The bearer token is missing.
`403`	`invalid_api_key`	The key is malformed, expired, revoked, or unknown.
`403`	`missing_api_key_scope`	The key lacks a scope required by the request.

{
  "status": "failed",
  "error": {
    "code": "missing_api_key_scope",
    "message": "This key does not have the required scope for this endpoint."
  }
}

Developer keys cannot create, list, revoke, or delete other keys through the public API. Use the dashboard for key management.

Start here

Concepts

Guides

Updates

Authenticate v3 API requests

Scopes

Key lifecycle

Authentication errors

​Scopes

​Key lifecycle

​Authentication errors

Scopes

Key lifecycle

Authentication errors