Authentication
Docyard uses API key authentication for all endpoints. This guide explains how to authenticate as a distributor or collector.API Key Authentication
All API requests require authentication headers:Authentication Headers
| Header | Description | Example |
|---|---|---|
X-API-Key | Your API key | dk_live_xxxxxxxxxxxx |
X-API-Secret | Your API secret | dk_secret_xxxxxxxxxxxx |
Key Types
Distributor Keys
Obtained when creating a ramp:dk_live_dist_ (production) or dk_test_dist_ (sandbox)
Collector Keys
Obtained when creating a dock:dk_live_coll_ (production) or dk_test_coll_ (sandbox)
Authentication Errors
Missing Credentials
Invalid Key
Invalid Secret
Expired Keys
Revoked Keys
Key Rotation
Rotate your API keys regularly for security.Rotate Distributor Keys
Rotate Collector Keys
Environment-Based Keys
Production Keys
- Used for real transactions
- Rate limits apply
- Full access
Test/Sandbox Keys
- Used for development
- Higher rate limits available
- Test data only
Best Practices
1. Store Keys Securely
Never commit API keys to version control:2. Use Separate Keys Per Environment
3. Rotate Keys Regularly
Set a calendar reminder to rotate keys every 90 days.4. Limit Key Scope
Use the least permissive keys necessary. Distributor keys shouldn’t be used for collector actions and vice versa.Code Examples
Node.js
Python
Go
Rate Limits
Rate limits are applied per API key:| Endpoint Type | Limit | Window |
|---|---|---|
| Upload (distributor) | 100 | per minute |
| Search (collector) | 300 | per minute |
| Retrieve (collector) | 100 | per minute |
Next Steps
- Errors - Error handling
- API Reference - Full API documentation