Authentication

Every request needs an Authorization: Bearer <key> header. Keys look like dm_live_<40 hex> and are scoped to a single team.

Creating a key

In the API Keys dashboard, click New key and give it a recognizable name (usually the environment or service that will use it). You will see the full key once in a dialog. After that, only the prefix is retrievable.

dm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Store the key in an environment variable, never in source control.

Sending the header

Authorization: Bearer dm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Applies to every POST /api/v1/* endpoint.

Rotating and revoking

Clicking Revoke in the dashboard deactivates a key immediately. The next request with a revoked key returns 401. To rotate, create a new key first, deploy it, then revoke the old one.

What keys see

A key can only read and modify data that belongs to its creator's team. Cross-team access is impossible by construction.

• Only team owners and admins can create or revoke keys.
• Team members see a read-only view.
• Revoking is instant. There is no cache.

Permissions

All keys currently carry the same scope (email_finder credits search_history). Fine-grained per-key permissions are a planned addition.