Skip to main content
Every API request must be authenticated with an API key, sent in the X-Api-Key header.
Requests without a key, or with a revoked or malformed one, return 401:
Keys are managed from the API Keys page in the dashboard. You can also reach it from the wallet menu in the top-right corner, under API Keys.

​
Creating a key

1

Open the API Keys page

Sign in at datadash.xyz and go to Settings → API Keys.
2

Name the key

Click Create key and give it a name, like production. Names are 1–30 characters, letters and digits only, with no spaces, dashes or underscores. Each name has to be unique within your account.
3

Copy the key

The key is shown once. Click Copy, store it somewhere safe, then click Done.
The key is shown once, at creation. Datadash stores only a hash of it and can never show it to you again. If you lose it, revoke the key and create a new one.

​
Viewing your keys

The API Keys page lists each key’s name, last three characters, and creation date. That’s enough to tell your keys apart without exposing them.

​
Revoking a key

Click the trash icon next to a key and confirm with Revoke key. Revocation takes effect within a few seconds across all servers, and every later request with that key returns 401. You can’t undo a revocation.

​
Keeping keys safe

  • Never ship a key in client-side code. Anything in a browser, mobile app, or public repository is readable by anyone. Call the API from your own server instead.
  • Use one key per environment or service. If a key leaks, you revoke just that one instead of breaking everything at once.
  • Load keys from environment variables or a secret manager, not from source.
  • Rotate on exposure. Create the replacement, switch traffic to it, then revoke the old key.
A key carries the full access of the account that created it. Treat it like a password.

​
Next steps

Filtering

Narrow any list endpoint with typed conditions and AND/OR groups.

Generate a client

Build a typed TypeScript or Python client from the OpenAPI spec.