Documentation

Authentication

Every route requires the `x-api-key` header. Without it, the API returns 401.

Required header

x-api-key: $OTEN_API_KEY

How to get a key

Oten Tecnologia provisions the key during customer onboarding. There is one key for sandbox and another for production. Never commit a production key to a repository or ship it in a public client.

Minimal example

curl -X POST 'https://api.otentecnologia.com.br/nfse' \
  -H 'x-api-key: $OTEN_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '[{"idIntegracao":"SP-001","prestador":{"cpfCnpj":"00000000000000"}}]'

Security

• Send the key in the header only — never in the URL.
• Keep it in server-side environment variables.
• Rotate the key if leakage is suspected.

Common errors