Authentication - Onstacks

The Onstacks API uses workspace API keys. Send the key as a bearer token in the Authorization header.

Authorization: Bearer <api_key>

API key format

Use the key value returned when the workspace API key is created. The API only returns the full token once. Store the token in a secret manager or server-side environment variable:

export ONSTACKS_API_KEY="osk_test_..."

Example request

curl "$ONSTACKS_API_URL/v1/balances?environment=sandbox" \
  -H "Authorization: Bearer $ONSTACKS_API_KEY"

Environments

Most resource routes accept environment=sandbox or environment=live. Use separate API keys for sandbox and live access when your workspace policy requires environment separation.

Scopes

API keys can be created with scopes such as:

wallets:read
transfers:read
transfers:create
transfers:approve
api_keys:manage
admin:*

Use the narrowest scope set required by the integration.

Security practices

Keep live API keys on trusted servers.
Do not place API keys in browser bundles, mobile apps, public repositories, or logs.
Rotate keys on a regular schedule.
Revoke keys immediately when they are no longer needed.
Use sandbox keys for test automation.