Have an API to sell?
Invokora Help Center
Invokora Help CenterSell APIs and services
How-to guide

Configure OpenAPI, origins, and authentication

Connect your real API with origin URLs, credentials, routing, and any request or response adaptations it needs.

On this page

Import or update the API document

  1. Open Endpoint in the product editor. Upload JSON/YAML, paste the document, or enter an OpenAPI HTTPS URL and select Import from URL.
  2. Use a self-contained OpenAPI 3.0.x or 3.1.x document no larger than 5 MiB. Internal $ref references are supported; merge external files and URL references into the document first.
  3. Save and check the parsed HTTP methods and paths, then configure each plan’s endpoint access under Pricing.
The OpenAPI editor contains YAML for GET /health, with file and URL import controls above.
Upload JSON/YAML or paste an OpenAPI document; GET /health is parsed after saving. Screenshot uses local demo data. View full-size image (opens in a new tab)

Set origin groups and routing

  1. Under Origin groups, enter a group ID and public HTTPS URLs, one per line. Choose a Default origin group for requests without a more specific rule.
  2. To route selected traffic elsewhere, select Add route and choose the endpoint scope, plan scope, and destination group.
  3. Rules take precedence in this order: endpoint and plan, endpoint, plan, then default. URLs rotate within a group, with one origin attempt per request.
The default origin group contains an example HTTPS URL and is selected as the default group.
Under Endpoint, enter your HTTPS origin and select the default group. Local demo data is shown; replace example.com with your own address. View full-size image (opens in a new tab)

Add origin credentials

  1. Under Origin credentials and trusted context, select Add injected field. Choose Header or Query, a field name, and a value source.
  2. For an origin requiring Authorization: Bearer …, choose Header, set the name to Authorization, choose Stored secret, and enter the complete Bearer prefix and real token.
  3. To include a buyer ID or plan code, choose Trusted Invokora context and the corresponding context field. Use endpoint and plan scopes to limit where the field applies.
  4. Secrets are hidden after saving. Leaving the value blank on a later edit retains the stored value. Keep origin secrets out of product descriptions and public OpenAPI examples.

Add transformations only when adaptation is needed

More settings
  1. Under Request and response transformations, select Add transformation. Choose the request or response phase, target, and an add, remove, copy, or rename operation.
  2. Limit the rule to the intended endpoints, plans, and Content-Type where needed. Use /path JSON Pointers for JSON fields.
  3. Save and retest affected endpoint and plan combinations. Check that the outgoing request and returned result still match your public documentation.

Save, test, and publish changes

  1. Set Origin timeout between 1 and 180 seconds and Maximum request/response body no higher than 50 MB, then save.
  2. Select each enabled Test plan and test its granted endpoints. Every URL in each effective origin group needs a passing test.
  3. Review the preview and publish. Saving a draft alone does not update the public product.
Update or unlist an API product

You may need next