Authentication & Scopes

All requests to https://edge.omnistatic.com must carry an authenticated API key in the Authorization HTTP header:

Authorization: Bearer omni_sk_live_1234567890abcdef...

API Key Format

Omni developer keys follow the standard prefix format:

omni_sk_live_<32-character-random-hex>

One-time display: Keys are shown once upon creation in the Developer Console and cannot be recovered.
Cryptographic hashing: Only the SHA-256 hash is persisted in the secure Omni credential registry.

Scopes & Permissions

Every key operates under explicit permission scopes:

Scope	Description	Default
`chat`	Execute chat completions, run agent sessions, and read curated models.	Yes
`memory:read`	Read memories, search memory vectors, and build context bundles.	Yes
`usage:read`	Query monthly token consumption and credit balances.	Yes
`memory:write`	Create, update, or delete semantic memories and documents.	Opt-in
`files:write`	Generate presigned upload URLs for workspace files.	Opt-in

If a request hits an endpoint without the required scope, the proxy returns 403 Forbidden with the error Missing required scope: <scope>.

Rate Limits & Guardrails

The edge control plane enforces dual-tier sliding window rate limits:

Window	Limit	Target	Status Code
Per-Key	60 requests / minute	Specific API key	`429 Too Many Requests`
Per-Principal	600 requests / hour	Account across all keys	`429 Too Many Requests`

Rate limit headers returned on 429 responses:

Retry-After: Seconds to wait before retrying.
X-RateLimit-Limit: Maximum permitted request quota.

Key Rotation & Revocation

To rotate a credential:

Navigate to Developer Console → API Keys (/dev/keys).
Generate a new key with identical scopes.
Update your server environment variables with the new key.
Revoke the old key from the console. Revocation is immediate across all global edge nodes.

Legacy Credential Compatibility

[!NOTE] Legacy API key formats remain supported for backward compatibility, but emit the response header X-Omni-Credential-Deprecated: true. Developers should migrate to omni_sk_live_* keys.