Authentication
All API requests require authentication via an API key. Keys are scoped to your organization and can be created in the dashboard.Sending your API key
Include your key in one of these headers (in order of preference):API key format
All keys use thedl_live_ prefix followed by a random string:
Scopes
Each API key has one or more scopes that control what it can access:
A key can also carry
equipment:write, crm:read, crm:write, proposal:read, proposal:write, task:read, and task:write. Those do not gate any REST endpoint today — they decide which tools an agent can reach over MCP.
A request to an endpoint outside the key’s scopes returns a 403 Forbidden error.
Creating API keys
- Go to Settings > API Keys
- Click Create API Key
- Name the key (e.g., “Production integration”)
- Select the scopes you need
- Copy the generated key immediately
Security best practices
Use the minimum scopes needed
Use the minimum scopes needed
Only grant the scopes your integration actually requires. You can always create additional keys with different scopes for different services.
Revoke a key you are done with
Revoke a key you are done with
Revoking is immediate and permanent. A key you no longer use is a key that can still be leaked.
Rotate keys regularly
Rotate keys regularly
Create a new key, update your integration, then revoke the old one. This limits exposure if a key is compromised.
Never expose keys in client-side code
Never expose keys in client-side code
API keys should only be used in server-side code. Never include them in browser JavaScript, mobile apps, or public repositories.