API Keys

Every request to the OnCore API authenticates with your tenant API key in the Authorization header:

Authorization: ApiKey YOUR_API_KEY

See Authentication for details.

Managing keys#

API keys are managed on the API Keys page in the OnCore dashboard. From there you can:

• View your current tenant API key.
• Generate a key for a tenant that doesn't have one yet.
• Rotate the key. Rotation immediately invalidates the previous key and issues a new one — there is no rollback, so update your integration with the new key right away and store it securely. Rotate on a regular schedule if your security policy requires it, or immediately if you suspect the current key has been compromised.

The API Keys page also holds your client server secret — the per-tenant shared secret OnCore uses to sign outbound webhook deliveries to your server. You use it to verify the signature on every webhook you receive; see Webhooks.

Handling keys safely#

• The API key is a server-side secret. Never embed it in browser JavaScript, mobile apps, or public repositories — anything shipped to a client can be extracted.
• For browser-facing features, exchange the key server-side for a short-lived token instead: see Web Chat and WebRTC Calls.
• Store keys in your secret manager, not in source control.