Skip to main content
The API keys page lives on the Business Unit navigation, between Members and Settings. There are two kinds of key, for two different doors. A secret key — the Developer API’s credential — is a pair:
  • Key ID (ok_…) — the public name of the key. Visible any time, safe to write in logs and support tickets; it identifies the key but cannot be used to call the API.
  • Secret (osk_…) — the credential itself. Shown exactly once, right after the key is created. Orriven stores only a hash: if the secret is lost, it cannot be recovered — you generate a new key and revoke the old one.
A secret key can read and write everything in its Business Unit. Treat the secret like a password: keep it in your server-side secret store, never in a browser, a mobile app, or a repository.
A publishable key (opk_…) — the Storefront API’s credential — is a single token that is public by design: it ships inside your frontend code and serves one portal’s public storefront (catalog, checkout, attendee sign-in). It carries no secret half, appears in full in the key list any time, and is created with two extra choices:
  • Portal — the one portal this key fronts. Its attendee accounts and its published events are the key’s whole world.
  • Allowed origins — the exact origins (https://tickets.your-site.com) your site runs on; browser requests from anywhere else are refused. Origins can be edited later — a site moving domains should not force you to rotate a key that is embedded in a deployed frontend.
The two kinds are mutually exclusive on the wire: each authenticates only on its own surface, and presenting one where the other belongs answers the standard 401.

​
Who can manage keys

Only organization Owners and Admins can view, generate or revoke keys. Planners and other roles do not have access — a key’s reach is broader than their own, so issuing one is an administrator’s decision.

​
Generating a key

1

Open API keys and choose Generate key

Name the key after the integration it is for — “CRM sync”, “check-in kiosk”. The name is for your own bookkeeping.
2

Copy the secret from the banner

The full secret appears once in a banner with a copy button. The banner cannot be dismissed for a few seconds — that is your window. Once you leave, only the prefix (osk_1a2b…) remains visible.
3

Call the API

Send the secret as a bearer token on every request:

​
The key list

Keys are listed in two sections, one per kind — the same shape as the Stripe dashboard. The secret-key list shows each key’s name, Key ID, secret prefix, pinned API version, when it was last used, and its status: Active, Revoked or Expired. The publishable-key list shows the full, copyable opk_ token, the portal it serves and its allowed origins (editable in place). “Last used” updates as your integration calls the API — a key that shows Never after deployment is a sign the integration is not reaching Orriven.

​
Revoking

Revoking a key kills it immediately: every request using it starts failing with the same 401 an unknown key gets. Revocation cannot be undone, and revoked keys stay in the list as a record. To rotate a credential, generate the new key first, switch your integration over, then revoke the old one — no downtime.

​
Rules to know

  • The secret appears once. Not in the list, not in any API response, not to support. Lost secret = new key.
  • One key, one Business Unit. A key never sees another unit’s data; a request for another unit’s event answers as if the event did not exist.
  • All key activity is audited. Generation and revocation appear in the audit log, and every write the key performs is recorded with the key as the actor.
  • Invalid means invalid. A missing, mistyped, revoked or expired secret all produce the identical 401 — the response never reveals whether a credential once existed.

Quickstart

First calls with your new key.

Members & roles

Why key management is Owner/Admin only.