Skip to main content
Send exactly one header:
Mint the token in Settings, API keys. It is bound to one workspace. Olympus stores a hash, not the secret. Rules:
  • Only personal tokens work on REST v1. New keys start with oly_; keys created before Oct 2026 start with olp_ and keep working until you revoke them.
  • ola_ and olr_ MCP OAuth tokens return 401 with WWW-Authenticate: Bearer.
  • Cookies and query credentials are ignored and cannot authenticate.
  • Every request rechecks membership, billing freeze, and role.
  • Creating a job needs CREATE_CONTENT (Owner, Admin, Standard). Reading jobs and offers needs VIEW_CONTENT (including Viewer).
  • Duplicate Authorization headers are rejected.
Missing or invalid credentials use problem type invalid_auth (401). A frozen workspace uses workspace_frozen (403). A Viewer creating a job uses forbidden (403).