Authentication

Okatana's external API uses organization-scoped bearer credentials. The SDK takes the complete token through OkatanaClientOptions.ApiKey and sends it as an HTTP bearer token.

using var client = new OkatanaClient(new OkatanaClientOptions
{
    BaseUrl = "https://okatana.example.com",
    ApiKey = Environment.GetEnvironmentVariable("OKATANA_API_KEY")!
});

Do not place the token in the URL, query string, ticket content, document content, logs, or source repository. The client never puts it into model objects or exception messages. A per-call header cannot replace Authorization.

Credential scope

A credential belongs to one organization. A valid token still receives 403 when the requested operation belongs to another organization or the token lacks the required scope. This is different from 401, which means the credential itself is absent, invalid, revoked, expired, or otherwise rejected.

Rotation

Treat API keys as revocable secrets. Use a secret manager, provision a replacement, deploy the new value, verify the integration, then revoke the old credential. Do not build workflows that depend on recovering an old secret value.

Workload separation

Prefer separate credentials for CI/CD, reporting, synchronization, and administrative automation. This reduces blast radius, makes audit events easier to identify, and prevents unrelated workloads from sharing the same per-credential rate limit.