Skip to main content
The Partner API is for resellers, agencies, and platforms that manage OneCLI for their customers. A partner sits one level above organizations. You create organizations for your customers, hand them ready-to-use credentials and a claim link, and let each customer take ownership when they’re ready.
Partner accounts are provisioned by the OneCLI team; there is no self-serve signup yet. Once your partner account exists, you receive a Partner API key and can manage everything below programmatically.

​
Authentication

The Partner API accepts two credentials:
  • Partner API key: a key prefixed oc_partner_, sent as a Bearer token. Use this for programmatic access.
  • Partner portal session: the dashboard session of a logged-in partner member. Use this from the portal UI.
For API calls, pass your Partner API key in the Authorization header: 
curl https://api.onecli.sh/v1/partner/orgs \
  -H "Authorization: Bearer oc_partner_your_key_here"
Treat your oc_partner_ key like a root credential. It can create organizations and mint the org, project, and agent tokens for every customer you manage. Store it in a secret manager and never commit it.

​
How it works

You provision an organization, the customer starts using it immediately with the tokens you pass them, and ownership transfers to the customer when they open the claim link.
1

Create an organization

Call POST /partner/orgs with a name. The response returns everything needed to run and to claim the organization.
2

Hand off the credentials and claim link

Give the org token, project token, and agent token to your customer (or wire them into your own tooling), and send them the claimUrl.
3

Customer claims ownership

The customer opens the claim link, signs in to OneCLI, and becomes the owner of the organization. Each organization has one claim link at a time.
4

Manage shared secrets and the org lifecycle

Optionally share partner-level secrets that every organization inherits, rotate tokens, reissue claim links, or add projects, all through the Partner API.

​
What you receive when you create an organization

POST /partner/orgs returns one ready-to-use organization with four credentials and a claim link:
FieldDescription
organizationIdID of the new organization.
projectIdID of its default project.
orgApiKeyOrganization-scoped API key (oc_org_…) for managing the org across projects.
projectApiKeyProject-scoped API key (oc_…) for the default project.
agentTokenAccess token for the default agent; route traffic through the gateway with this.
claimUrlThe link your customer opens to claim ownership of the organization.
{
  "organizationId": "org_8f3c1a9b",
  "projectId": "proj_2d7e4f10",
  "orgApiKey": "oc_org_1b9d…",
  "projectApiKey": "oc_7a2f…",
  "agentToken": "aoc_4e8c…",
  "claimUrl": "https://onecli.sh/claim?token=9a229f90b2ec5bf0…"
}
These tokens are shown once, in this response only. They are never returned again, so store them when you create the organization. If they’re lost, call POST /partner/orgs/{orgId}/rotate-tokens to mint new ones.

​
Before an organization is claimed

A newly created organization is unclaimed until a customer opens its claim link. While it’s unclaimed:
  • LLM calls work: your customer (or your tooling) can start using agents against Anthropic, OpenAI, and other LLM hosts right away.
  • Other external calls are paused: any non-LLM request through the gateway returns a claim_required response containing the claim link, so the customer is prompted to finish setup.
Once claimed, the organization behaves like any other OneCLI organization and the customer is its owner.

​
Partner-managed secrets

Secrets you create with POST /partner/secrets are inherited by every organization you manage. They’re the lowest-priority credential tier: when a host matches at more than one level, project secrets override organization secrets, which override partner secrets. This lets you set a shared credential (say a fallback LLM key) once, and have it apply across all your customers’ organizations without provisioning it per org. Customers see inherited secrets as read-only. A customer can stop inheriting your secrets at any time by detaching their organization (POST /org/partner/detach). Detaching keeps the organization, and its attribution to you, but stops applying partner secrets.

​
Managing organizations

ActionEndpoint
List your organizationsGET /partner/orgs
Inspect one organizationGET /partner/orgs/{orgId}
Reissue a claim linkPOST /partner/orgs/{orgId}/claim-link
Rotate org + project tokensPOST /partner/orgs/{orgId}/rotate-tokens
Delete an unclaimed organizationDELETE /partner/orgs/{orgId}
Add or remove projectsGET/POST/DELETE /partner/orgs/{orgId}/projects
Reissuing claim links, rotating tokens, deleting an organization, and managing projects are only allowed while an organization is unclaimed. After a customer claims it, the organization is theirs to manage.

​
Endpoint reference

Browse the full request and response details under these groups in the API Reference:
  • Partner Organizations: create, list, inspect, delete, reissue claim links, rotate tokens.
  • Partner Projects: add and remove projects on an unclaimed organization.
  • Partner Secrets: manage credentials inherited across every organization.
  • Organization Partner: check partner status and detach (called by the customer’s organization, not by the partner).