Skip to main content
Public /api/v1 requests use an account API key as a Bearer token (or X-API-Key).
Treat the API key as a server-side secret. Do not put it in browsers, mobile apps, public repos, or logs.

Get your API key

  1. Log in to the Ondial dashboard.
  2. Open API Access.
  3. Submit a request with:
    • Key name — friendly label (e.g. Production CRM) shown in your list and to Super Admin
    • Modesandbox or live
    • Why — short use-case note for approval
  4. Super Admin approves (or denies). On approve, the operator receives the plaintext key once.
  5. Optionally Rename the key later in API Access (does not change the secret).
Tenants cannot self-issue live keys.

Try It

  1. Open Ping.
  2. Paste the key into BearerAuth (playground adds Bearer).
  3. Choose Production or Local (localhost:3001).
  4. Send.

cURL

Alternative header: X-API-Key: $ONDIAL_API_KEY.

Revoke / rotate / kill switch

  • Tenant Rotate / Delete from API Access (or Super Admin rotate/revoke) → old secret stops working
  • Super Admin revoke / suspend401 unauthorized
  • Global kill switch → 503 api_globally_disabled on all /api/v1/*