API Keys

Create and manage API keys to authenticate requests to your DYPAI backend.

Overview

API keys provide a simple way to authenticate machine-to-machine communication:

• Server-to-server integrations
• Backend services
• CI/CD pipelines
• Third-party integrations

Creating API Keys

Key Types

Using API Keys

Include your API key in the request headers:

// JavaScript/TypeScript
const response = await fetch('https://your-project.dypai.io/api/v1/users', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
    'X-API-KEY': 'your-api-key-here'
  }
});

With cURL

curl -X GET \
  'https://your-project.dypai.io/api/v1/users' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: your-api-key-here'

With Python

import requests

response = requests.get(
    'https://your-project.dypai.io/api/v1/users',
    headers={
        'Content-Type': 'application/json',
        'X-API-KEY': 'your-api-key-here'
    }
)

data = response.json()

Environment Variables

Store API keys in environment variables:

# .env file (never commit to git!)
DYPAI_API_KEY=your-api-key-here

# Use in code
const apiKey = process.env.DYPAI_API_KEY;

Key Permissions

Configure granular permissions for custom keys:

{
  "permissions": {
    "database": {
      "users": ["read"],
      "posts": ["read", "write"],
      "comments": ["read", "write", "delete"]
    },
    "storage": {
      "avatars": ["read", "write"],
      "documents": ["read"]
    },
    "functions": ["execute"]
  }
}

Rate Limiting

API keys have configurable rate limits:

// Rate limit headers in response
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1704067200

Revoking Keys

Revoke API keys immediately if compromised:

1. Go to project settings → API Keys
2. Find the key to revoke
3. Click "Revoke" and confirm

Key Rotation

Regularly rotate API keys for security:

1. Create a new API key
2. Update your applications to use the new key
3. Verify everything works with the new key
4. Revoke the old key

Security Best Practices

• Never expose keys in client-side code or public repositories
• Use environment variables or secret managers
• Rotate keys regularly (every 90 days recommended)
• Use the minimum permissions necessary
• Monitor key usage for anomalies
• Revoke unused or compromised keys immediately

Next steps

• Set up user authentication
• Create endpoints
• Query your database