API keys

Keys for calling the API from your servers. Integrators manage them here.

Endpoints

The api key object

A secret key for calling the API from your servers, sent in the x-api-key header. Its secret is shown once, when it is created.

Attributes

idstring
Unique identifier of the api key, prefixed with key_. Treat it as an opaque string: store it and compare it, never parse it.
objectstring
Names the type of this object. Always api_key.
namestring
Your label for the key, for example where it is used.
previewstring
The first characters of the key, to recognise it. Never enough to authenticate with.
scopesarray of string
What the key may do. Integrator keys carry quotes:read, quotes:write, orders:read, orders:write, orders:read_customer, extras:read, extras:write, wallet:read, webhooks:read.
created_attimestamp
Point in time, ISO 8601 in UTC.
last_used_attimestamp or null
When the key last authenticated a request, to the minute. Null if it was never used.

The api key object

null

List API keys

GET/v2/api-keys

Credentials: A signed-in dashboard session only; API keys are refused.
For: Integrators
Operation id: list_api_keys

Lists your active API keys, newest first, without their secrets. Revoked keys are not listed. Integrators only, and only with a signed-in dashboard session: an API key cannot manage keys (credential_not_allowed).

Returns200 OK

Your active keys, all on one page.

Responses

200
Your active keys, all on one page.
401
Credentials are missing (missing_credentials), the API key is unknown or inactive (invalid_api_key), the session expired (invalid_session), or both a key and a session were sent (ambiguous_credentials).
403
The credentials are valid but not allowed to do this: a scope is missing (missing_scope), the endpoint is for another kind of account (actor_not_allowed) or another kind of credential (credential_not_allowed), the account may no longer use the API (account_blacklisted), or the account must change something first, in which case details.fix_url links to the dashboard page that fixes it.
429
Too many requests (rate_limited): the limit is 500 per minute per API key (or signed-in user). Wait for the number of seconds in the Retry-After header, then retry; details has limit, window_seconds, reset_at and retry_after_seconds.

Errors use the error object.

GET/v2/api-keys

curl "https://public-api.dapi.digital/v2/api-keys" \
  -H "x-api-key: $DAPI_API_KEY"

Response

{
  "object": "list",
  "data": [
    {
      "id": "key_bfP0GSqKoZFrD72H5Os0rc7HV9XP6eQJu",
      "object": "api_key",
      "name": "Production server",
      "preview": "sk_3f9a1c2b7...",
      "scopes": [
        "quotes:read",
        "quotes:write"
      ],
      "created_at": "2026-10-20T09:30:00Z",
      "last_used_at": null
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Create an API key

POST/v2/api-keys

Credentials: A signed-in dashboard session only; API keys are refused.
For: Integrators
Operation id: create_api_key

Creates a secret key for calling the API from your servers. The response is the only time the full key (secret) is shown; store it securely.

Keys work before your account is approved, with the same onboarding limits as the dashboard. Up to 10 active keys per account; revoke one to make room.

Integrators only, and only with a signed-in dashboard session: an API key cannot manage keys (credential_not_allowed).

Request body

namestringRequired
A label for the key, 1 to 50 characters.
scopesarray of stringRequired
What the key may do. Allowed for integrators: quotes:read, quotes:write, orders:read, orders:write, orders:read_customer, extras:read, extras:write, wallet:read, webhooks:read.

Returns201 Created

The key, with its secret shown once.

Responses

201
The key, with its secret shown once.
400
The request is invalid (validation_failed).
401
Credentials are missing (missing_credentials), the API key is unknown or inactive (invalid_api_key), the session expired (invalid_session), or both a key and a session were sent (ambiguous_credentials).
403
Called with an API key instead of a session (credential_not_allowed), or not an integrator account (actor_not_allowed).
409
You already have 10 active keys (key_limit_reached). Revoke one first.
422
A scope is unknown or not allowed for your account (scope_not_allowed, details.scopes). Allowed: quotes:read, quotes:write, orders:read, orders:write, orders:read_customer, extras:read, extras:write, wallet:read, webhooks:read.
429
Too many requests (rate_limited): the limit is 500 per minute per API key (or signed-in user). Wait for the number of seconds in the Retry-After header, then retry; details has limit, window_seconds, reset_at and retry_after_seconds.

Errors use the error object.

POST/v2/api-keys

curl -X POST "https://public-api.dapi.digital/v2/api-keys" \
  -H "x-api-key: $DAPI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Production server",
  "scopes": [
    "quotes:read",
    "quotes:write"
  ]
}'

Response

{
  "id": "key_bfP0GSqKoZFrD72H5Os0rc7HV9XP6eQJu",
  "object": "api_key",
  "name": "Production server",
  "preview": "sk_3f9a1c2b7...",
  "scopes": [
    "quotes:read",
    "quotes:write"
  ],
  "created_at": "2026-10-20T09:30:00Z",
  "last_used_at": null,
  "secret": "sk_3f9a1c2b7d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e41"
}

Revoke an API key

DELETE/v2/api-keys/{id}

Credentials: A signed-in dashboard session only; API keys are refused.
For: Integrators
Operation id: revoke_api_key

Revokes a key at once: the next request made with it is refused with invalid_api_key. This cannot be undone. Integrators only, and only with a signed-in dashboard session: an API key cannot manage keys (credential_not_allowed).

Path parameters

idstringRequired
Unique identifier of the api key, prefixed with key_. Treat it as an opaque string: store it and compare it, never parse it.

Returns200 OK

The key was revoked.

Responses

200
The key was revoked.
401
Credentials are missing (missing_credentials), the API key is unknown or inactive (invalid_api_key), the session expired (invalid_session), or both a key and a session were sent (ambiguous_credentials).
403
The credentials are valid but not allowed to do this: a scope is missing (missing_scope), the endpoint is for another kind of account (actor_not_allowed) or another kind of credential (credential_not_allowed), the account may no longer use the API (account_blacklisted), or the account must change something first, in which case details.fix_url links to the dashboard page that fixes it.
404
You have no active key with this id (api_key_not_found).
429
Too many requests (rate_limited): the limit is 500 per minute per API key (or signed-in user). Wait for the number of seconds in the Retry-After header, then retry; details has limit, window_seconds, reset_at and retry_after_seconds.

Errors use the error object.

DELETE/v2/api-keys/{id}

curl -X DELETE "https://public-api.dapi.digital/v2/api-keys/key_bfP0GSqKoZFrD72H5Os0rc7HV9XP6eQJu" \
  -H "x-api-key: $DAPI_API_KEY"

Response

{
  "id": "key_bfP0GSqKoZFrD72H5Os0rc7HV9XP6eQJu",
  "object": "api_key",
  "deleted": true
}