Skip to main content

Authentication

The dashboard surface (/v1/*) authenticates with a bearer token:

Authorization: Bearer <token>

The token is one of:

  • a user session token, which is how the Orderly dashboard authenticates, or
  • a provisioned API key, for server-to-server and API-only integrations.

Keep tokens in a secrets manager or secure server-side session. Do not include them in browser code, client logs, URLs, or support messages.

Organization scoping​

Data is per-organization. Org-scoped routes require the active organization in a header:

X-Organization-Id: <your-organization-uuid>

Routes such as /v1/overview fall back to a global view when the header is omitted; routes such as /v1/live-shipments, /v1/network, /v1/scorecard, /v1/flags, /v1/slas, and the ingest routes require it and return 400 org_required without it.

Browser requests​

The Try it consoles send preview requests directly from this documentation site. For customer applications, call the API from your backend so credentials remain private. If a Try it request reports a network error, retry once and check Orderly status before contacting support.

Rate limits​

Requests are rate limited per principal in a fixed window (default 600 requests / 60s). Exceeding it returns 429.

Example​

curl https://api.orderlycore.com/v1/overview \
  -H "Authorization: Bearer $ORDERLY_INTEL_KEY" \
  -H "X-Organization-Id: $ORG_ID"