Authentication

You are reading the v1 reference. v1 keeps working unchanged; new capabilities (several identities per request, risk scores, richer module data) are in v2. See migrating from v1.

One bearer token on every request. Keys are created in the dashboard and shown once.

Sending your key

Header

Authorization: Bearer dfp_your_key

Keys are prefixed dfp_ and stored hashed, so we cannot show you a key again after it is created, only revoke it and issue a new one.

Keep keys server-side

A key carries your whole account's quota, so it belongs on your server, never in a browser or mobile app where anyone can read it. If a key leaks, revoke it in the dashboard. Revocation takes effect on the next request.