Authentication

The NetraOCR API authenticates every request with an API key + secret pair, sent using HTTP Basic authentication.

• Username → your api_key (public identifier, looks like ak_…)
• Password → your api_secret (secret, looks like sk_…)

Authorization: Basic base64(api_key:api_secret)

Most HTTP clients build this header for you when you supply a username and password — you rarely need to base64-encode it by hand.

Sending credentials

cURL

curl https://netraocr.shivicx.com/api/v1/templates \
  -u "ak_live_xxxxxxxx:sk_live_xxxxxxxx"

Python

import requests

resp = requests.get(
    "https://netraocr.shivicx.com/api/v1/templates",
    auth=("ak_live_xxxxxxxx", "sk_live_xxxxxxxx"),
)
print(resp.json())

Node.js

const auth = Buffer.from("ak_live_xxxxxxxx:sk_live_xxxxxxxx").toString("base64");

const res = await fetch("https://netraocr.shivicx.com/api/v1/templates", {
  headers: { Authorization: `Basic ${auth}` },
});
console.log(await res.json());

PHP

<?php
$ch = curl_init("https://netraocr.shivicx.com/api/v1/templates");
curl_setopt($ch, CURLOPT_USERPWD, "ak_live_xxxxxxxx:sk_live_xxxxxxxx");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);

IP allow-listing (required)

Every API key carries a mandatory IP allow-list of exact IPv4/IPv6 addresses (single IPs — CIDR ranges are not accepted). A request is rejected with 403 if:

• the key has no allow-list, or
• the caller's IP is not on the key's list.

This means a key only works from servers whose public IPs you've explicitly registered. To find the IP the API sees for your current host, call GET /api-keys/my-ip. Manage the list with PATCH /api-keys/{key_id}/ip-whitelist.

Keep keys server-side

Because credentials grant full access from allow-listed IPs, treat the api_secret like a password. Use it only from backend servers — never embed it in browsers, mobile apps, or public repositories.

Getting credentials

API keys are created in the console (Settings → API Keys) or via the API Keys API. The api_secret is shown only once, at creation time. If you lose it, revoke the key and create a new one.

Errors

Status	Meaning
401 Unauthorized	Missing or invalid credentials
403 Forbidden	Caller IP not on the key's allow-list (or no list set)

See Errors for the full list and response shape.

Rotating credentials

To rotate, create a new key + secret pair, deploy it, then revoke the old key. Key and secret stay bound together for traceability — you don't rotate the secret independently of its key.

Next: Managing API Keys.