Skip to main content
One credential: an API key on the Authorization header.
Keys are minted by the Ωmegas team and shown exactly once. The TypeScript client reads OMEGAS_OPERATOR_API_KEY from the environment; over raw HTTP you send the header yourself.
GET /v1/whoami answers with the key’s identity and is the cheapest way to check a credential without touching anything.

​
Scopes

A key carries scopes and, optionally, a list of Spaces. Missing either is 403 insufficient_scope. Two rows deserve emphasis:
  • operator:sessions:control is separate on purpose. A key issued for monitoring cannot be turned into a key that types into a logged-in browser.
  • GET /v1/audit reads with operator:audit:read. Keys minted before that scope existed carried operator:webhooks:read for the audit route, and the historical scope is still accepted there, so an existing key keeps working.
A Space-scoped key must name a Space it holds on every list; an org-wide key may omit it and sees the whole organization.

​
A credential must not reach a URL

A URL is a publishing surface: access logs, span fields, error reporters, proxies, Referer headers. This product has already had one credential leak that way, which is why the client refuses to let it happen again rather than asking integrators to be careful:
  • The key is wrapped in a Credential whose toString, toJSON and inspection output all return omg_operator_<env>_<key_id>_***. The only function that reveals the secret returns an Authorization header.
  • Query strings are scanned for credential-shaped values and the request throws before it is sent.
  • Live-view session tokens ride the Sec-WebSocket-Protocol header (omega.operator.v1, omega.token.<ops_…>), never a query parameter, and the server-supplied ws_url must match the API origin and must be wss:.
  • Redirects are refused outright; following one would replay the Authorization header at a host nobody validated.
If you integrate over raw HTTP, adopt the same rules. They are cheap before a leak and expensive after one.