Authentication

API keys

Keys are created and revoked in the panel at Settings → Developers (/settings/developers) by an owner or admin of the business, or by an admin key through POST /v1/api-keys.

A key has three parts: the dak1 prefix, a public id, and a secret. Only a SHA-256 hash of the secret is stored, so a key is shown once, at creation, and can never be displayed again.

Each key belongs to one business and carries one scope. Use a separate key per integration so you can revoke one without breaking the others — the panel shows each key's last use.

dak1.3f9a01c2.9d1e…40 hex…
│    │        └─ secret (hashed at rest)
│    └─ key id (8 hex)
└─ version prefix

Sending the key

Put it in the Authorization header on every request, over HTTPS. Query-string keys are not accepted: URLs end up in logs.

curl https://api.digitalagency.tools/v1/ping \
  -H "Authorization: Bearer $DA_API_KEY"

{
  "data": { "ok": true, "time": "2026-11-05T10:00:00+00:00" },
  "meta": { "request_id": "req_2a9e0b7d4c316f1c" }
}

Revoking a key

Revoke from Settings → Developers, or with DELETE /v1/api-keys/{id}. It takes effect on the very next request — there is no cache to wait out.

When authentication fails

A missing, malformed, unknown or revoked key answers 401 unauthorized. A valid key without the scope an endpoint needs answers 403 forbidden; a business whose plan does not include API access answers 403 feature_not_enabled.

{
  "error": {
    "type": "unauthorized",
    "message": "Send an API key as: Authorization: Bearer <key>."
  },
  "meta": { "request_id": "req_7d4c316f1c2a9e0b" }
}