Static API Keys

Companies use static API keys to authenticate directly with the OlaClick Public API. These keys are generated from the OlaClick panel, are bound to a single company, and never expire.

Key format

Environment	Prefix	Base URL
Production	olk_live_	https://public-api.olaclick.app
Sandbox	olk_test_	https://public-api.olaclick-stg.click

Using a key in the wrong environment returns 401.

Usage

Send the API key in one of these headers on every request:

Authorization header (Bearer)

GET /v1/orders HTTP/1.1
Host: public-api.olaclick.app
Authorization: Bearer olk_live_a1b2c3d4e5f6...

X-API-Key header

GET /v1/orders HTTP/1.1
Host: public-api.olaclick.app
X-API-Key: olk_live_a1b2c3d4e5f6...

Both methods are equivalent. If you send both headers with the same key, it works. If you send both with different keys, the request is rejected with 400.

Error responses

Responses

200

Request authenticated successfully.

400

Sent different keys in Authorization and X-API-Key headers simultaneously.

401

Missing, invalid, or revoked API key. Or using a olk_test_* key in production (or vice versa).

403

The API key does not have the required scope for this endpoint.

---

Key characteristics

Property	Value
Expiration	Never — valid until revoked
Scope	Bound to a single company
Rate limit	Based on the company's plan tier
Revocation	From the OlaClick panel