Credentials¶
Okatana External API credentials are organization-scoped bearer credentials. The SDK sends them as:
The current Okatana guide shows the token form as oka_<public-id>.<secret> and states that a credential belongs to one organization.
Secret handling¶
Store credentials in a secret manager, injected environment variable, or equivalent runtime secret facility. Do not put them in:
- source code;
- example files;
- Git history;
- tickets or documents;
- command output captured by CI logs;
- exception messages;
- observability event attributes.
The SDK's HttpEvent does not contain headers or the API key.
Rotation¶
Create a replacement credential with the minimum required scopes, deploy it, verify access, then revoke the previous credential. Treat a 401 after rotation as a configuration or credential lifecycle problem, not as a retryable transient failure.