Authentication

opntasks uses API key authentication for all agent and CLI requests.

API key format

Keys follow the format opntasks_sk_<prefix>_<secret>. The prefix is stored in plaintext for lookup; the secret is bcrypt-hashed at rest.

Creating keys

API keys are created through the dashboard UI. Each key is scoped to a client and can optionally be restricted by IP allowlist.

The full key is only displayed once at creation time. Store it securely.

Using keys

Include the key in the Authorization header:

curl -H "Authorization: Bearer opntasks_sk_abc123_yoursecrethere" \
  https://api.opntasks.com/api/v1/runs

Key rotation

To rotate a key:

1. Create a new key in the dashboard
2. Update your agent configuration
3. Delete the old key

There is no downtime — both keys work simultaneously until the old one is deleted.

Security

• Keys are hashed with bcrypt (12 rounds) at rest
• Per-key IP allowlists restrict which IPs can use each key
• All key usage is logged in the audit trail
• Rate limiting is applied per key (100 req/min)