Public /api/v1 requests use an account API key as a Bearer token (or X-API-Key).
Treat the API key as a server-side secret. Do not put it in browsers, mobile apps, public repos, or logs.
Get your API key
- Log in to the Ondial dashboard.
- Open API Access.
- Submit a request with:
- Key name — friendly label (e.g.
Production CRM) shown in your list and to Super Admin
- Mode —
sandbox or live
- Why — short use-case note for approval
- Super Admin approves (or denies). On approve, the operator receives the plaintext key once.
- Optionally Rename the key later in API Access (does not change the secret).
Tenants cannot self-issue live keys.
Try It
- Open Ping.
- Paste the key into BearerAuth (playground adds
Bearer).
- Choose Production or Local (
localhost:3001).
- Send.
cURL
Alternative header: X-API-Key: $ONDIAL_API_KEY.
Revoke / rotate / kill switch
- Tenant Rotate / Delete from API Access (or Super Admin rotate/revoke) → old secret stops working
- Super Admin revoke / suspend →
401 unauthorized
- Global kill switch →
503 api_globally_disabled on all /api/v1/*