To use the Ownright Partner API, you must authenticate each request with a set of headers that identify your application and prove that the request is authorized. The authentication process is simple and stateless — just supply three headers with each request.

​
Overview

Every API request must include the following headers:

  • X-Ownright-Client-Id - Identifies your registered API client
  • X-Ownright-API-Key - Authenticates your request

  • X-Ownright-Organization-Id - Specifies the Ownright platform organization

All three headers are required for every request to the Partner API.

​
Steps to obtain and use an API key

1

Register an API client

Contact the Ownright team ([email protected]) to register your application. Once registered, you’ll receive a unique client ID. You must include this in the X-Ownright-Client-Id header in every request.

Self-service client registration will be available in the Partner Dashboard soon.
2

Request an API key

Our team will issue one or more long-lived API keys tied to your API client record. These act like permanent access tokens. You must include the API key in the X-Ownright-API-Key header with every request.

Treat your API keys like secrets — keep them out of client-side code and version control.
3

Add the organization ID

All requests must include a shared X-Ownright-Organization-Id header. This value is constant across all partners and identifies the core Ownright platform internally.

We’ll provide the correct value during onboarding. There is no need to manage or change this identifier.

​
Sample request

POST /partners/graphql HTTP/1.1
Host: api.ownright.com
X-Ownright-Client-Id: your-client-id
X-Ownright-API-Key: your-api-key
X-Ownright-Organization-Id: ownright-prod-org
Content-Type: application/json

{
  "query": "query { referral(id: \"gid://ownright/Referral/1\") { id status } }"
}

​
Security and key management

  • API keys are tied to your business account and logged internally
  • Store them securely — rotate if compromised
  • Contact [email protected] to revoke or generate new keys

  • Webhook signature verification is covered separately in the Webhooks section