Getting Started

Authentication

All requests to the Otonum API must be authenticated with an API key.

API Key Header

Include your API key in the x-api-secret header on every request:

Code
x-api-secret: YOUR_API_KEY

For operation-specific call examples, refer to the API Reference.

Generating an API Key

1. Log in to the Otonum Rewards App
2. Go to Applications -> API Access
3. Click New client secret
4. Copy the key immediately because it is shown only once

Managing API Keys

You may generate multiple API keys (for example one per integration or environment). Keys can be revoked independently.

Action	How
Create a new key	Applications -> API Access -> New client secret
Revoke a key	Click the delete icon next to the key
Rotate a key	Create a new key, update your integration, then revoke the old key

Environments

Otonum provides two environments:

Environment	Base URL
🚀 Production	https://api.otonum.io
🧪 Sandbox	https://api.sandbox.otonum.io

Use Sandbox during development and testing so real rewards are not issued.

Error Responses

If authentication fails, the API returns 401 Unauthorized.

If the key is valid but lacks permission for the operation, the API returns 403 Forbidden.

Security Best Practices

• Never embed API keys in client-side JavaScript, mobile binaries, or public repositories
• Rotate keys regularly and immediately after suspected compromise
• Use environment variables for runtime key injection on the server side
• Scope keys per integration when possible