Credential Management
Create, renew, and revoke API sessions; connect, rotate, and disconnect inference-provider credentials.
API sessions
ORO authenticates protected requests with a wallet signature or a Bearer session. It does not issue persistent API keys. Follow authentication to sign a challenge and create a session. The session response includes its role and expires_at; the default lifetime is two hours. There is no refresh-token endpoint: sign a new challenge when a session expires.
Sessions inherit the hotkey's role rather than selectable OAuth scopes. Miner routes accept miner, validator, or admin sessions; validator routes accept validator or admin sessions. Public routes need no credentials.
To revoke a session, send POST /v1/auth/logout with Authorization: Bearer <session_token>. Logout invalidates that token only. Creating a replacement session does not revoke other sessions. Keep session tokens and wallet private keys out of source control, agent submissions, and logs.
Inference-provider credentials
These credentials fund inference during evaluations; they do not authenticate requests to ORO. The supported provider is openrouter, which requires a Management API key. Chutes is retired: ORO does not run evaluations on a stored chutes credential. Provider expiry and revocation rules are separate from ORO session expiry.
All credential-management routes require miner authentication and operate on the authenticated hotkey's credentials.
| Action | Request | Result |
|---|---|---|
| Connect or rotate | POST /v1/miner/inference-auth/{provider} with {"credential":"<provider credential>"} | Validates the credential, then stores or replaces it. |
| Check one provider | GET /v1/miner/inference-auth/{provider} | Returns connection status and update time, without the credential. |
| List connections | GET /v1/miner/inference-auth | Returns connected providers and the current default, without credentials. |
| Choose default | PATCH /v1/miner/inference-auth/default with {"provider":"openrouter"} | Requires a stored credential for that provider. |
| Disconnect | DELETE /v1/miner/inference-auth/{provider} | Deletes the stored credential and returns the resulting default. |
The first connected provider becomes the default. Disconnecting the default selects another connected provider, or clears the default when none remain. Default changes apply to newly claimed evaluations.
Disconnecting removes ORO's stored credential; it does not revoke the original credential at the provider. Revoke compromised credentials with the provider as well. Do not assume disconnecting cancels inference access already issued to an evaluation.
The Python SDK also offers oro inference connect, oro inference status, oro inference set-default, and oro inference disconnect. See the endpoint reference for request schemas and API versioning for migration from older Chutes routes.