Authentication

Authenticate to the Origin One API with a bearer API token.

The Origin One API authenticates every request with an API token passed as a bearer token in the Authorization header.

Get an API token

Please request your API Key.

When your token is created, it is configured with:

• A tenant — your organization on the Origin One platform.
• Companies — the specific companies the token can access. All data returned by the API is scoped to these companies.
• Scopes — the operations the token is allowed to perform. See Scopes.

Authenticate requests

Pass the token in the Authorization header of every request:

curl https://api.origin.one/api/v2/locations \
  --header "Authorization: Bearer $ORIGIN_ONE_API_TOKEN"

Authentication errors

Status	Meaning
401 Unauthorized	The token is missing, invalid, expired, or lacks a required scope.
403 Forbidden	The token is valid but the requested resource is outside its access (for example, a location that belongs to a company the token is not linked to).
404 Not Found	Some endpoints return 404 instead of 403 to avoid revealing whether a record exists.

Token security

• Never embed tokens in client-side code, mobile apps, or public repositories.
• Store tokens in a secrets manager or environment variables, not in source control.
• Request separate tokens per integration so access can be revoked independently.
• If a token is compromised, contact Origin One immediately to revoke it.