Skip to content
dhanu docs
Browse pages
Changelog Join our community Contact support

Overview

Authentication

Authentication

API keys

How Dhanu API keys authenticate, how project scopes limit what a key can reach, and how to rotate or revoke one.

Every public API request authenticates with a bearer key:

Authorization: Bearer dhanu_sk_test_…

There is no other credential. Session cookies cannot reach the public API, and an API key cannot reach the app’s management API — the two are kept completely separate.

Keys are shown once

When you create or rotate a key, the secret is displayed exactly once. Only a hash of it is stored, so it cannot be recovered afterwards. If you lose it, rotate the key to mint a new secret; the old one stops working immediately.

Project scopes

A key belongs to a workspace and is scoped to an explicit set of projects. You must select at least one project when creating a key, and every generation is metered against a project in that scope.

How the acting project is chosen:

  • Single-project key — the project is implied. You can omit projectId.
  • Multi-project key — you must pass projectId on each generation request. Omitting it fails with project_id_required (422).
  • Out of scope — passing a projectId the key does not cover fails with api_key_project_scope (403).

A key whose scope resolves to zero active projects — because they were all deselected or the projects were archived — stops working entirely, with api_key_project_scope (403), before any endpoint runs.

Access is tied to its creator

A key keeps working only while the person who created it still has developer access in that workspace. If their Developer role is removed, or they are removed from or demoted in the workspace, the key stops working with developer_access_revoked (403).

This is deliberate: a key that leaked, or that an ex-colleague kept, dies with their access rather than outliving it.

Rotating and revoking

Rotate when a key may have leaked but the integration should keep running. You get a new secret; deploy it and the old one is dead.

Revoke when the integration is finished. A revoked key fails with api_key_revoked (401) and cannot be brought back.

Checking a key

curl https://api.dhanu.ai/api/pub/v1/me \
  -H "Authorization: Bearer $DHANU_API_KEY"

A 200 tells you the key is live and shows exactly which projects it can reach. A 401 means the key is unknown or revoked; a 403 means it is real but no longer permitted.