Authentication

Call Owctopus from your server. The API key lives in the environment and is sent over HTTPS, from an SDK or from any HTTP client.

The key

import { Owctopus } from "@owctopus/sdk";

const owctopus = new Owctopus({
  apiKey: process.env.OWCTOPUS_API_KEY,
});

Live keys use the ow_live_ prefix. Test keys use ow_test_. The full secret is shown once, when the key is created.

Where the key stays

• In an environment variable on the server that calls decide().
• On the request to the Owctopus API, over HTTPS. HTTP clients send Authorization: Bearer.

Keep the key out of browser code, logs, and error messages. Owctopus is a backend SDK.

Local API

Point the client at your local API while you build. Production omits the base URL and uses https://api.owctopus.com.

const owctopus = new Owctopus({
  apiKey: process.env.OWCTOPUS_API_KEY,
  baseUrl: "http://localhost:3000",
});