Authentication - Origin One API

The Origin One API authenticates every request with an API token passed as a bearer token in the Authorization header.

Get an API token

Please request your API Key. When your token is created, it is configured with:

A tenant — your organization on the Origin One platform.
Companies — the specific companies the token can access. All data returned by the API is scoped to these companies.
Scopes — the operations the token is allowed to perform. See Scopes.

Pass the token in the Authorization header of every request:

curl https://api.origin.one/api/v2/locations \
  --header "Authorization: Bearer $ORIGIN_ONE_API_TOKEN"

Status	Meaning
`401 Unauthorized`	The token is missing, invalid, expired, or lacks a required scope.
`403 Forbidden`	The token is valid but the requested resource is outside its access (for example, a location that belongs to a company the token is not linked to).
`404 Not Found`	Some endpoints return 404 instead of 403 to avoid revealing whether a record exists.

Never embed tokens in client-side code, mobile apps, or public repositories.
Store tokens in a secrets manager or environment variables, not in source control.
Request separate tokens per integration so access can be revoked independently.
If a token is compromised, contact Origin One immediately to revoke it.