Welcome to the Ouro API. You can use our API to access the functionality of the Ouro platform and build it into your own applications.
Skip the intro and dive into the API reference
Install and connect the Ouro MCP interface
The Ouro API uses API keys to authenticate requests. You can view and manage your API keys in your settings.
Your API keys allow you to make requests to the Ouro API on behalf of your account. Just about anything you can do from the Ouro platform, you can do from the API.
Follow these steps to obtain and use your API key:
OURO_API_KEYRemember to keep your key secure and never share it publicly. Don't share your keys in publicly accessible areas such as GitHub, client-side code, and so forth.
If you suspect your token has been compromised, delete it immediately and generate a new one.
When you create a key you choose where it acts:
| Acts in | What the key can do |
|---|---|
| Personal (default) | Works in your personal context. In organizations it sees only what is public, and can't create or change anything there. |
| One organization | Works only in that organization. Outside it, the key sees only what is public. |
| Everywhere | Works in your personal context and every organization you belong to. Keys made before October 2026 work this way. |
A key bound to one place is the safer choice for an agent or a deployed service: if it leaks, the rest of your work is out of reach. Use a key made for an organization when the work belongs there, including when the organization pays for its members' usage.
A key that acts everywhere runs in your personal context unless the request
names an organization, with Ouro(organization=...) or OURO_ORG_ID in the
Python SDK and
MCP server, or the X-Ouro-Org
header (an organization ID) over HTTP. API clients never follow the
organization you last selected in the web app.
| Refusal | Meaning |
|---|---|
api_key_org_mismatch | 403. The key is bound to a different context than the one the request named or tried to write to. |
org_context_forbidden | 403. You aren't a member of the organization the request named. |
invalid_org_context | 400. X-Ouro-Org wasn't an organization ID. |
Ouro uses conventional HTTP response codes to indicate the success or failure of an API request.
In general: Codes in the 2xx range indicate success.
Codes in the 4xx range indicate an error that failed given the information provided (e.g., a required parameter was omitted, a charge failed, etc.).
Codes in the 5xx range indicate an error on Ouro's servers (these are rare).
| Code | Description |
|---|---|
200 | Everything worked as expected. |
400 | Bad Request - The request was unacceptable, often due to missing a required parameter. |
401 | Unauthorized - No valid API key provided. |
402 | Request Failed - The parameters were valid but the request failed. |
403 | Forbidden - The API key doesn't have permissions to perform the request. |
404 | Not Found - The requested resource doesn't exist. |
409 | Conflict - The request conflicts with another request (perhaps due to using the same idempotent key). |
429 | Too Many Requests - Too many requests hit the API too quickly. We recommend an exponential backoff of your requests. |
5xx | Server Errors - Something went wrong on Ouro's end. |
On this page