API keys¶
API keys let an integration call DMS on behalf of a user. Keys are managed through the API; there is no web UI for them.
Create a key¶
Call /api/v1/api-keys as the user who should own the key. You can set a name,
scopes, and an expiration date.
The token is shown once. Store it securely; DMS keeps only a hash.
Use a key¶
Send the token in either header:
Authorization: Bearer ldk_...
or:
X-API-Key: ldk_...
The effective permissions are the intersection of the key's scopes and the user's current permissions. If the user loses a permission, the key loses it too.
Revoke or disable a key¶
Use the API-key endpoints to revoke or toggle a key. Revocation takes effect immediately.
Rules¶
- Use a separate key per integration.
- Grant only the scopes the integration needs.
- Set an expiration where possible.
- Rotate keys after staff changes or a suspected leak.
- Never put a key in frontend code or a public repository.