Authentication - Originalis API

Every request needs an Originalis API key, sent either way:

curl -H "Authorization: Bearer ak_..." "https://api.originalis.ai/api/v1/deals"
curl -H "X-API-Key: ak_..."            "https://api.originalis.ai/api/v1/deals"

Keys are minted in the app at Integrations → API Keys; the secret is shown once. Keys support expiry, overlap rotation, and immediate revocation.

Server-resolved identity

Keys are bound to a user in your org. Identity and org scope are resolved server-side from the key — the API never accepts a client-supplied user or organization, and a key can never read another org’s rows (a cross-org resource is a plain 404).

Read vs. write scope

Scope	Can do
Read-only	Every `GET`
Read & write	Everything, plus the `POST` actions (analysis, research) and webhook management

A read-only key calling an action gets 403 with a pointer to the keys page. Actions additionally draw down a separate daily actions budget.