Developers
Authentication
Every request to the Partner API carries an API key as a bearer token. A key identifies a business, never a person, and is only ever seen by your server.
Sending your key
Put the raw key in the Authorization header on every request. There is no login step and no token to refresh.
Authorization: Bearer sk_live_a1b2c3d4e5f6g7h8i9j0
Content-Type: application/jsoncurl https://api.okadadrop.com/api/v1/partner/deliveries \
-H "Authorization: Bearer $SOMA_API_KEY"Anatomy of a key
| Part | What it is |
|---|---|
| sk_live_ | What it isPrefix. Always this — there is no test key today, so treat every key as one that dispatches real riders and moves real money. |
| a1b2c3… | What it is256 bits of randomness. The first 14 characters are the key_prefix shown in the dashboard, so you can tell keys apart without exposing the secret. |
What a key can reach
A key resolves to your partner account. Deliveries you book belong to it and nobody else can read them — and every key on your account shares that identity, so a delivery booked with an old key is still visible after you rotate to a new one.
Storing it
The secret is returned exactly once, in the response that creates it. OkadaDrop stores only a SHA-256 hash, so we cannot show it to you again and a stolen copy of our database yields nothing usable. If you lose it, revoke the key and mint another.
Rotating
Mint the replacement first, deploy it, then revoke the old key. Both work at once for as long as you need, and revocation takes effect on the next request. In-flight deliveries booked with the revoked key carry on untouched.
Rate limits
Requests are counted per key: 120 requests per minute. Over the line you get a 429 with a Retry-After header telling you how many seconds until the window resets. Back off for that long rather than retrying immediately.
HTTP/1.1 429 Too Many Requests
Retry-After: 60
{
"error": {
"code": "http_error",
"message": "API rate limit exceeded. Please slow down.",
"details": {}
}
}Test and live
There is one environment today, and keys are prefixed sk_live_ accordingly: a delivery you book is a real delivery that a real rider will come and collect. Point a second key at your staging deployment of OkadaDrop if you need a sandbox — mint one labelled Staging so the two are never confused in your dashboard.