authentication

Bearer keys

Every request carries an API key in the Authorization header. Keys are created and revoked in Dashboard, API.

The header

Authorization: Bearer dlk_live_xxxxxxxxxxxxxxxxxxxx

Keep keys server-side, in an environment variable. Never ship a key in front-end code or a public repo.

Scopes

Each key carries one or more scopes. Grant only what an integration needs.

  • read — all GET endpoints: stats, visitors, SEO, listings.
  • write — create and modify: sites, goals, funnels.
  • export — bulk export of raw events and payments.

Rotation

To rotate, create a new key, deploy it, then revoke the old one. Revoked keys are refused immediately.

When auth fails

A missing, invalid or revoked key returns 401; a valid key without the needed scope returns 403.

401
{ "error": { "code": "unauthorized",
    "message": "Invalid or revoked API token. Manage your keys in Dashboard, API." } }