Every request carries a Bearer token in the Authorization header.
| Token | Prefix | Acts as | Use it for |
|---|---|---|---|
| Partner API key | opk_ |
Your partner account | Server-to-server integration |
| Personal access token | opt_ |
The person who created it, with their current permissions | Scripts and tools |
| Session token | none | A person signed in to the app | The web app only |
Partner API keys
Create and revoke keys in Settings, API keys, or with POST /v1/partners/{partnerId}/api-keys. A key is shown once and stored only as a hash. Keys can manage your organizations and payroll data, but they cannot create other keys or change who has access. Give each key an expiry and rotate it by creating a new key before revoking the old one.
Personal access tokens
A person creates these under Security in the app. They carry the person's permissions as they are at the time of each request, so removing someone's access also limits their tokens.
Scope of a request
Odin resolves every request to a point in your hierarchy before doing anything else. A request for an organization or entity outside your partner returns 404, never 403, so the existence of other tenants' data is never revealed.