Authentication

Customer API keys #

Send Authorization: ApiKey <public_id>:<secret>. The gateway resolves institution identity from the credential. Route-specific entitlements govern operations such as quote writes, balance reads and credential changes.

curl "$OSAI_API_BASE_URL/v1/balances" \
  -H "Authorization: ApiKey $OSAI_PUBLIC_ID:$OSAI_API_SECRET" \
  -H "X-Osai-Correlation-Id: balance-read-1042"

Console sessions #

Company workspaces and the configured identity provider establish institutional sessions. Role, institution, account eligibility and recent MFA affect access. Authentication does not replace independent financial approval. State-changing browser requests require the configured Origin and X-CSRF-Token; the browser manages the session cookie.

const response = await fetch("/api/auth/session", { credentials: "include" });
if (!response.ok) throw new Error("Session unavailable");
const session = await response.json();

Market-data access #

Use Authorization: Bearer <feed-token> against the feed base URL. Access is scoped to configured feeds and roles; it does not grant order execution authority. Financial API keys are not substitutes for feed credentials.

Secret handling #

• Keep application keys server-side and grant only necessary permissions.
• Redact Authorization, cookies, signing secrets and activation tokens from logs.
• Treat 401 as an authentication problem and 403 as permission or policy denial.
• Coordinate credential rotation before invalidating an application’s old secret.