Authentication
Generate an API key, send it with every request, and manage it over its life: revoking, storing it safely, and what happens on a plan change. Team and Agency.
By Operelio team · Updated July 2026
On this page5
How authentication works
Every Operelio API request carries an API key that identifies your workspace. No key, or a bad key, and the request is refused. This guide is the key's whole life: making one, sending it, revoking it, and keeping it safe. If you just want to see a call work first, start with the API quickstart.
API keys are on the Team and Agency plans.
Generating an API key
Go to the API Keys page in the app, enter a name (e.g. "Production" or "Testing") and click Generate. The full key is shown once, on the same page. Copy it immediately and store it somewhere safe. Once you dismiss the panel, you can't view it again.
By default only workspace admins can create API keys. An admin can let every member create their own keys under Team settings (Settings → Team → Settings → API keys). Revoking a key is always admin-only, whichever way that setting is configured.
API keys are 35 characters: the prefix "op_" followed by 32 random hex characters. The dashboard's keys list shows the first 8 (e.g. "op_a2f99…") so you can recognize a key without having the full secret. To revoke a key, find it in the list, click Revoke, and confirm. The key starts returning 401 immediately and you can generate a replacement.
Using the key
Include your API key in the Authorization header of every request, with the word Bearer in front of it:
Authorization: Bearer op_your_api_key_here
The header must start with exactly "Bearer op_". A missing header, a typo, or a revoked key all return 401 Unauthorized.
Keeping your key safe
Treat your API key like a password. It can act on your workspace's files, jobs, and quotas, so anyone who holds it can do what you can. Do not commit it to version control, share it in chat, or include it in client-side code. Use environment variables or a secrets manager. If you think a key has been compromised, revoke it immediately from the API Keys page and generate a new one.
Frequently asked questions
Who can create API keys?
By default only workspace admins can create keys. An admin can open key creation to every member under Team settings (Settings → Team → Settings → API keys). Revoking a key is always admin-only, whatever that setting is. If a member needs to create keys and you'd rather not open it up for everyone, make them an admin.
Can I have multiple API keys?
Yes. Generate as many as you need from the API Keys page. The 60-requests-per-minute rate limit applies per key, so separate keys for production and testing don't compete for the same allowance. The monthly API call cap is counted per workspace, though, so extra keys don't add monthly capacity.
What happens if I revoke a key?
Any requests using that key immediately return 401 Unauthorized. Generate a new key and update your integration.
What happens to my keys if I downgrade to a plan without API access?
If your workspace drops below Team (to Free or Pro), your keys stop working. Every request returns 401, but the keys themselves stay in your account. If you upgrade back to Team or Agency, the same keys resume working without you having to regenerate or update your integration.
Where should I store my API key?
Treat it like a password. Use environment variables in production, a secrets manager (1Password, AWS Secrets Manager, etc.) for shared use, or your CI/CD platform's encrypted secrets for automated jobs. Don't commit keys to version control or paste them into chat.
Ready to get started?
Upload a file and run your first transformation. Free, no credit card required.