0BitDeveloper Docs
0Bit public documentation

Organization API keys

The one 0Bit authority for organization-scoped publishable and secret keys.

Every pk_* and sk_* key belongs to one 0Bit Organization. The institutional Account service issues, lists, and revokes those keys; product APIs verify them against that authority. Gate and 0Bit Institutional do not maintain competing key stores.

Credential Use Storage rule
pk_test_* / pk_live_* Browser-safe bootstrap or discovery operations that explicitly accept a publishable key May be included in a client bundle
sk_test_* / sk_live_* Server-to-server product API calls Server secret manager only

Key management

Organization owners and administrators manage keys through the Account surface:

GET    /account/organizations/:organizationId/api-keys
POST   /account/organizations/:organizationId/api-keys
DELETE /account/organizations/:organizationId/api-keys/:keyId

The raw secret is returned only when a key is created. Stored records retain a non-secret prefix and a one-way digest, so the original value cannot be read back later.

Authorization has three parts

A syntactically valid key is not enough. A product request is accepted only when all three checks pass:

  1. The key is active and its test/live mode matches the target host.
  2. The Organization is entitled to the product or capability.
  3. The key carries every scope required by the endpoint.

Unknown, revoked, cross-mode, unentitled, or under-scoped credentials deny access. Product-specific setup, such as verification or an allowlist, may add a further guard without creating a second credential authority.

API hosts

Surface Base URL
0Bit Institutional https://api.0bit.app
Gate live https://gate-api.0bit.app
Gate sandbox https://gate-api-sandbox.0bit.app

Use the same organization identity across products, but create separate keys when you need different modes, scopes, applications, or rotation schedules.

Rotation

  1. Create a replacement key with the required type, mode, and scopes.
  2. Move the consuming service to the replacement.
  3. Confirm requests use the new key.
  4. Revoke the old key.

See Account model for Accounts, Organizations, memberships, and entitlements.