Skip to content

docs(protocol): correct the X-API-Key example to the real osk_ prefix#8733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 1 commit into from
Aug 14, 2026
+9 −1
Merged

docs(protocol): correct the X-API-Key example to the real osk_ prefix #8733

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion content/docs/protocol/kernel/http-protocol.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -263,9 +263,17 @@ Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
**2. API Key:**
```http
GET /api/v1/data/task
X-API-Key: sk_live_abc123...
X-API-Key: osk_abc123...
```

ObjectStack API keys always carry the `osk_` prefix, and the prefix is load-bearing
rather than decorative. Besides the `X-API-Key` header, a key may be presented with the
`Authorization` header using either the `ApiKey` scheme or the `Bearer` scheme — but the
`Bearer` form is accepted **only** when the token starts with `osk_`. That prefix test is
what keeps the two senses of `Bearer` apart: a session token never starts with `osk_`, so
it still resolves down the session path in method 1 and can never be read as an API key.
A key without the prefix does not authenticate.

**3. Session Cookie:**
```http
GET /api/v1/data/task
Expand Down
Loading