Skip to content
Dot
DocsSign inGet started

API authentication

Create a workspace API key and authenticate a server-to-server request.

The API authenticates with a workspace API key sent as a bearer token. The key identifies the workspace, so your request never names a tenant and cannot reach another one.

Create a key

  1. 1

    Open the developer area

    Developer → API keys, in the workspace the key should belong to.

  2. 2

    Create and name it

    Name it after the system that will use it, so revoking later is obvious.

  3. 3

    Copy it once

    The full key is shown exactly once. Afterwards only a short prefix is stored for identification.

  4. 4

    Store it as a secret

    Put it in your server's secret store or environment. Never in client code or a repository.

Key format

A key looks like dot_live_ followed by 32 URL-safe characters. Only a SHA-256 hash and the display prefix are stored, so a database disclosure does not hand anyone a working credential.

Use it

Authorization header
curl https://app.example.com/api/v1/public/chat \
  -H "Authorization: Bearer $DOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "chatbotId": "YOUR_CHATBOT_ID", "messages": [] }'

Calling from a browser or mobile app

Do not put the key in the client. Proxy through your own backend, which holds the key and forwards the stream, or use the website embed, which is designed for untrusted pages.

Rotating and revoking

  • Create the replacement key first, deploy it, then revoke the old one — there is no downtime that way.
  • Revoking is immediate and permanent; a revoked key cannot be restored.
  • Each key records when it was created and when it was last used, which is how you find one nothing is using any more.