Authentication

Every request carries an API key as a bearer token:

Authorization: Bearer <your key>

A request without one is answered 401 with the code missing_key.

What a key reaches

A key reaches the sites it was given, with a level for each part of Dnero:

Level	Means
none	Nothing. The key cannot see this part of Dnero at the site.
read	Look things up.
write	Look things up, and create and change them.

GET /v1/me lists them. Asking for a site the key does not reach is answered as if the site did not exist, so a key cannot be used to learn which sites another organisation has.

Keys for the API and keys for the assistant

Dnero issues two kinds of key from the same screen: API keys, for your systems, and assistant keys, for connecting an AI assistant. Each works only where it was made for: an assistant key sent to the API is refused with assistant_key.

Rotating a key

Keys do not need to change on a schedule, but when one has to - someone who had it has left, or it may have been exposed:

1. Make a new key with the same access.
2. Deploy it to your system.
3. Revoke the old one under Automation > Access. It stops working within a minute.

Keeping keys safe

• Keep keys on your servers. The API does not accept requests from browsers.
• Use one key per system, so revoking one stops only that system.
• Give each key only the sites and levels it needs.