Skip to main content
Every API request must be authenticated with an API key, sent in the X-Api-Key header.
Requests without a key, or with a revoked or malformed one, return 401:
Keys are managed over the API itself — there is no dashboard screen for it. Your first key has to be created with an access token, since you don’t yet have a key to authenticate with.

​
Getting an access token

The API accepts either an X-Api-Key header or an Authorization: Bearer header carrying your Privy access token. The dashboard already sends that token on every request, so the quickest way to get one is to lift it from your own browser session.
1

Sign in to the dashboard

Open datadash.xyz and log in.
2

Open the Network tab

Open DevTools (F12, or ⌥⌘I on macOS) and select Network. Filter to Fetch/XHR.
3

Find a request to the API

Click around the app so it loads data, then pick any request going to api.datadash.xyz. The RPC calls are named after the method — ListTable, GetMetadata, and so on.
4

Copy the Authorization header

In Headers → Request Headers, find authorization. Copy everything after Bearer .
Access tokens are short-lived and refresh as you use the dashboard. Use one to mint an API key, then authenticate with the key from then on — a token copied out of the browser will stop working, and it carries your full account access until it does.

​
Creating a key

Names are 1–30 characters, letters and digits only — no spaces, dashes or underscores. The name is how you refer to the key later, so it has to be unique within your account. Once you hold a key, you can create further keys with it instead of a token, by swapping the header:
The key is returned once, at creation. Datadash stores only a hash of it and can never show it to you again. Save it somewhere safe immediately — if you lose it, delete the key and create a new one.

​
Listing your keys

page is required; limit must be between 1 and 1000.
Listing returns each key’s name, creation time, and last three characters — enough to tell your keys apart without exposing them. Page through with offset.

​
Revoking a key

Delete a key by name. Revocation takes effect within a few seconds across all servers.
A key can delete itself. If you revoke the key you’re authenticating with, the call succeeds and every later request with it returns 401.

​
Keeping keys safe

  • Never ship a key in client-side code. Anything in a browser, mobile app, or public repository is readable by anyone. Call the API from your own server instead.
  • Use one key per environment or service. If a key leaks, you revoke just that one instead of breaking everything at once.
  • Load keys from environment variables or a secret manager, not from source.
  • Rotate on exposure. Create the replacement, switch traffic to it, then delete the old key.
A key carries the full access of the account that created it. Treat it like a password.

​
Next steps

Filtering

Narrow any list endpoint with typed conditions and AND/OR groups.

Generate a client

Build a typed TypeScript or Python client from the OpenAPI spec.