Every request to the Partner API requires your API key. Pass it in an HTTP header —
either Authorization: Bearer (recommended) or X-API-Key.
Migration notice. The API key used to be passed as an apiKey query parameter.
The ?apiKey= query parameter still works for backward
compatibility, but it is deprecated and will be removed in a future release.
Migrate your integrations to the header as soon as possible.
Passing your API key
Send your key as a Bearer token:
If your stack does not manage the Authorization header, use X-API-Key instead:
Both headers are equivalent. If both are present, Authorization takes precedence.
Query parameter (deprecated)
Do not expose your API key in client-side code. Always call the Ochy API from
your backend server.
Getting an API key
Contact sales through the Ochy website or from your account to request a partner account.
Once your organization is set up, generate an API key from the
web dashboard.
Error responses
If authentication fails, the API returns one of these responses:
Missing API key — 401
Returned when no API key is provided in the Authorization header, the X-API-Key
header, or the apiKey query parameter.
Invalid API key — 403
Returned when the key does not match any active partner account.
Credits
Each analysis consumes one credit from your account balance. The credit is debited
atomically when the analysis starts, not when results are retrieved. If starting the
analysis then fails on our side, the credit is automatically refunded.
Insufficient credits — 424
Returned when your account has no remaining credits at the time the analysis is started.
To add credits, contact sales through the Ochy website or from your account.
Security best practices
- Pass the key in a header, not the
apiKey query parameter.
- Store your API key in environment variables or a secrets manager — never hard-code it.
- Rotate your key periodically from the web dashboard.
- Monitor your credit usage to avoid unexpected exhaustion.