Ora Repot
Dashboard

OTP

Authentication

Every request to api.orarepot.com uses a bearer token issued in OTP Settings. There is no OAuth dance.

Authorization: Bearer orp_live_<secret>

Rules

  • The full key is shown once at creation time.
  • Revoke it in the dashboard if it leaks.
  • Keep it on your server — never in a merchant customer’s browser.
  • Public host is api.orarepot.com, not orarepot.com/api.