OMSCourse Search API
DemoAPI reference
Getting started

Authentication

Every search request must include a secret API key in the Authorization header.

Header
Authorization: Bearer oms_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Key types

  • oms_live_… for your production site.
  • oms_test_… for staging and development. Same data and engine, lower limits.

Keeping keys safe

  • Call the API only from your server (WordPress PHP, Node.js, etc.). Your browser code calls your own server.
  • Store keys in environment variables or wp-config.php, not in themes, Git repositories or page source.
  • OMS stores only a one-way fingerprint of your key and cannot show it again. If a key is lost or exposed, ask OMS to rotate it: you get a new key and the old one keeps working for an agreed grace period, then stops.
CORS is not authentication. The API sends no cross-origin headers, so browsers cannot call it directly. That is deliberate: CORS only controls what browsers do, and anyone can call an API from a script. The secret key is what protects access, so it must stay on your server.

Authentication errors

  • 401 missing_api_key: no or malformed Authorization header.
  • 401 invalid_api_key: the key doesn't exist.
  • 403 key_revoked: the key was revoked or its rotation grace period ended.