Developer API · updated 2026-08-22

Authentication and API keys

Every request authenticates with an API key sent as a Bearer token. This article covers how keys work, how they are stored, and how to manage their whole lifecycle: create, revoke, schedule auto-revocation, and recover from a leak.

1. 1

   How authentication works

   Send the key in the Authorization header of every request:

   Authorization: Bearer dc_live_...

   The server hashes the presented key with SHA-256 and matches it against the stored fingerprint. The raw key is never stored anywhere on our side, which is why it can only be shown once at creation. Every request also re-checks that your company's API access is still approved, so a revocation takes effect on the very next call.

2. 2

   Key anatomy

   Keys look like dc_live_ followed by 64 hex characters (256 bits of randomness). The dc_live_ prefix plus the first characters are kept visible in your key list so you can tell keys apart; the rest exists only in your copy.

3. 3

   Create and name keys

   Settings, API, "Create key". You can hold up to 5 active keys per company. Use one key per integration so you can revoke one system without breaking another.

4. 4

   Revoke immediately

   The Revoke button stops a key on the next request. Revocation is permanent: re-enabling access later never resurrects old keys, you mint new ones.

5. 5

   Schedule automatic revocation

   Each key has an optional auto-revoke date ("Auto-revoke" button). Perfect for contractors or temporary integrations: the key dies at the end of the chosen day without anyone having to remember.

6. 6

   If a key leaks

   Revoke it immediately in Settings, API, and create a replacement. Every key creation, revocation and schedule change is logged in the platform audit trail, so our support team can reconstruct exactly what a leaked key was used for if you need it. Under our Terms of Service the key is your responsibility, so rotate early when in doubt.