Send your key as a bearer token in the Authorization header. Keys start da_live_ and are 40 characters long.
Authorization: Bearer da_live_3f9c…Keys are not accepted in the query string. A key in a URL ends up in logs, proxies, browser history and screenshots, so the API does not look for one there.
When a key is refused
| Status | Code | What happened |
|---|---|---|
| 401 | no_key | No Authorization header, or no bearer token in it. |
| 401 | bad_key | Something was sent, but it is not shaped like a Darts API key. |
| 401 | unknown_key | A well-formed key that is not ours, or one that has been rotated. |
Rotating your key
Rotate from your dashboard. The old key stops the moment the new one is issued, so put the new one in place first. Your plan, usage and history stay with your account, not the key.