Skip to main content

API keys and authentication

Orbis Studio uses API keys to authenticate programmatic access to your flows and resources.

Orbis Studio API keys​

An Orbis Studio API key allows you to call flows and interact with the platform via the REST API. Each key inherits the permissions of the user who created it.

Create an API key​

  1. In the Orbis Studio header, click your profile icon and select Settings.
  2. Click API Keys.
  3. Click Add New, enter a name for the key, and click Save.
  4. Copy the key immediately — it will not be shown again.

Use an API key​

Include your API key in the x-api-key request header when calling the Orbis Studio API:


_10
curl -X POST \
_10
"https://your-orbis-studio-url/api/v1/run/FLOW_ID" \
_10
-H "x-api-key: YOUR_API_KEY" \
_10
-H "Content-Type: application/json" \
_10
-d '{"input_value": "Hello"}'

Replace your-orbis-studio-url with your Orbis Studio server address, FLOW_ID with your flow's ID, and YOUR_API_KEY with your key.

Revoke an API key​

  1. Go to Settings → API Keys.
  2. Click the delete icon next to the key you want to revoke.

Revoking a key immediately invalidates it. Any integrations using that key will stop working.

Component credentials​

Components that connect to external services (model providers, databases, third-party APIs) require their own credentials. These are stored separately from Orbis Studio API keys.

The recommended way to manage component credentials is through Global Variables — see Global variables.

User authentication​

Access to the Orbis Studio platform is managed by your organization's Orbis Studio administrator. Orbis Studio supports the following authentication methods:

  • Username and password — default login method
  • Active Directory (AD), LDAP, and OIDC — for corporate identity provider integration

Contact your Orbis Studio administrator to request access or reset credentials.

Login rate limiting​

Orbis Studio applies IP-based rate limiting to the /login endpoint to protect against brute-force attacks. When the limit is exceeded, Orbis Studio returns HTTP 429 with a Retry-After header.

Your Orbis Studio administrator can tune this behavior with the following environment variables:

VariableFormatDefaultDescription
ORBISAGENTS_​RATE_​LIMIT_​PER_​MINUTEInteger5Maximum number of login attempts allowed per minute from a single IP address.
ORBISAGENTS_​RATE_​LIMIT_​STORAGE_​URIStringmemory://Storage backend for rate limit counters. Use memory:// for single-server deployments or redis://host:port for multi-server deployments where the limit should be shared across instances.
ORBISAGENTS_​RATE_​LIMIT_​TRUST_​PROXYBooleanFalseWhen true, Orbis Studio reads the client IP from the rightmost X-Forwarded-For header entry instead of the direct connection IP. Enable only when Orbis Studio is behind a trusted reverse proxy or load balancer.

SSRF protection​

Orbis Studio blocks Server-Side Request Forgery (SSRF) by default. Components that fetch user-supplied URLs, such as API Request, URL, RSS Reader, and SearXNG Search, refuse requests to private IP ranges, loopback addresses, link-local addresses, and cloud metadata endpoints such as 169.254.169.254. This applies to hostnames that resolve to those addresses and to redirect targets.

To let flows reach trusted internal services, add them to ORBISAGENTS_SSRF_ALLOWED_HOSTS instead of turning protection off.

VariableFormatDefaultDescription
ORBISAGENTS_​SSRF_​PROTECTION_​ENABLEDBooleanTrueWhen true, requests to private or internal addresses are blocked with an error. Set to false only if you accept that flows can reach any internal service and cloud metadata endpoint.
ORBISAGENTS_​SSRF_​ALLOWED_​HOSTSList[String]Not setComma-separated hosts, IP addresses, wildcard domains, or CIDR ranges that bypass SSRF checks, for example 192.168.1.0/24,10.0.0.5,*.internal.company.local. Ignored when protection is disabled.