Skip to content
omnismith docs

Access Tokens (API Keys)

Personal Access Tokens (omni_*) enable secure programmatic access to Omnismith APIs without storing user login credentials in external scripts or background workers.

1. Creating an Access Token

Section titled “1. Creating an Access Token”
  1. Navigate to Access & Security → Access Tokens in the sidebar launcher.
  2. Click + Create Token.
  3. Token Name: Enter a descriptive integration name (e.g. Server Monitoring Agent or Zapier Webhook Sync).
  4. Expiration: Choose an expiration period (e.g., 30 days, 90 days, or custom date).
  5. Click Generate Token.
  6. One-Time Secret Reveal: Copy the generated omni_* token value immediately. For security reasons, the secret key cannot be displayed again after you close the modal.

Access token creation modal showing name input and one-time secret reveal

2. Using Tokens in REST API Requests

Section titled “2. Using Tokens in REST API Requests”

Pass the access token in the Authorization HTTP header of your REST requests:

Terminal window
curl -X GET "https://api.omnismith.io/api/v1/entity/template/{templateId}" \
  -H "Authorization: Bearer omni_live_secret_key_12345" \
  -H "X-Project-Id: {projectId}"

💡 Developer Architecture Note

Section titled “💡 Developer Architecture Note”

[!NOTE] Hashed Storage & Scope Restrictions: Raw access tokens are never stored in the database — only cryptographically hashed representations are persisted. API tokens inherit the exact RBAC role permissions assigned to the token creator.

Next Steps

Section titled “Next Steps”

[!TIP]

  • Test endpoints using OpenAPI / Swagger documentation.
  • Monitor active user sessions in Sessions.