Authentication

The Hub API accepts two credential types, both as a bearer token:

Authorization: Bearer <token>

API key (oh_...) is for server-to-server integrations. Create and manage keys in the dashboard under API Keys. Keys carry scopes (for example orders:read, shipments:write) that gate what they can do.
User session token authenticates requests made from a signed-in Orderly session.

Organization selection

Accounts can belong to multiple organizations. Select the active one with:

X-Organization-Id: <organization-uuid>

API keys are restricted to explicit scopes. A call outside a key's scopes returns 403. Common scopes:

Scope	Grants
`orders:read`	List and read orders
`orders:write`	Create and update orders
`shipments:read`	List and read shipments
`shipments:write`	Create shipments and labels
`bridges:read`	List bridges and their status

curl https://api.orderly-hub.com/api/v1/orders \
  -H "Authorization: Bearer $ORDERLY_API_KEY" \
  -H "X-Organization-Id: $ORG_ID"