Authentication

Authentication

Otonix supports two auth modes.

• Web app sessions: SIWE with Privy embedded wallets.

• API access: Otonix API keys via X-API-Key.

Privy wallets (web app)

• Each user gets an embedded EVM wallet.

• The app uses SIWE for wallet-based sessions.

• Use this when a human is driving the UI.

Otonix API keys (server-to-server)

API keys are used by agents and infrastructure.

Key format

• Prefix: otonix_

• Body: 48 hex characters (random)

• Example header:

X-API-Key: otonix_a1b2c3d4e5f6...

Generate API key

POST /api/keys/generate

Request

curl -sS -X POST "https://app.otonix.tech/api/keys/generate" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Agent Key",
    "ownerWallet": "0x742d35Cc6634C0532925a3b844Bc9e7595f..."
  }'

Response (201)

{
  "id": "uuid",
  "key": "otonix_a1b2c3d4e5f6...",
  "name": "My Agent Key",
  "status": "active",
  "agentCount": 0,
  "createdAt": "2026-02-20T12:00:00.000Z"
}

The full key is only returned once. Store it securely.

List API keys

GET /api/keys

Request

curl -sS "https://app.otonix.tech/api/keys"

Response (200)

[
  {
    "id": "uuid",
    "key": "otonix_a1b2c3...d4e5",
    "name": "My Agent Key",
    "status": "active",
    "agentCount": 2,
    "createdAt": "2026-02-20T12:00:00.000Z"
  }
]

Revoke API key

Revocation deactivates all agents linked to the key.

DELETE /api/keys/:id

Request

curl -sS -X DELETE "https://app.otonix.tech/api/keys/uuid"

Response (200)

{
  "id": "uuid",
  "status": "revoked",
  "deactivatedAgents": 2
}

Common auth errors

• 401 if X-API-Key is missing or invalid.

• 403 if the key is valid but not authorized for the resource.

401 example

{ "error": "unauthorized", "message": "Valid Otonix API key required" }