Skip to main content
Every API request must be authenticated with an API key, sent in the X-Api-Key header.
Requests without a key, or with a revoked or malformed one, return 401:

​
Creating a key

Create a key from your dashboard, or programmatically:
Key names are 1–30 characters, letters and digits only.
The key is returned once, at creation. DataDash stores only a hash of it and can never show it to you again. Save it somewhere safe immediately — if you lose it, delete the key and create a new one.

​
Listing your keys

Listing returns each key’s name, creation time, and last three characters — enough to tell your keys apart without exposing them.

​
Revoking a key

Delete a key by name. Revocation takes effect within a few seconds across all servers.

​
Keeping keys safe

  • Never ship a key in client-side code. Anything in a browser, mobile app, or public repository is readable by anyone. Call the API from your own server instead.
  • Use one key per environment or service. If a key leaks, you revoke just that one instead of breaking everything at once.
  • Load keys from environment variables or a secret manager, not from source.
  • Rotate on exposure. Create the replacement, switch traffic to it, then delete the old key.
A key carries the full access of the account that created it. Treat it like a password.

​
Next steps

Filtering

Narrow any list endpoint with typed conditions and AND/OR groups.

API Reference

Every endpoint, with its fields, filters and response shape.