> ## Documentation Index
> Fetch the complete documentation index at: https://dashtray.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API with API keys

# Authentication

All Dashtray API requests require authentication via API keys.

## API Key Format

API keys follow this format:

```
sk_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
```

**Format breakdown:**

* `sk_` - Prefix indicating this is a secret key
* `test` - Environment marker (all keys currently use `sk_test_` regardless of plan)
* `<random>` - 48 hexadecimal characters (24 random bytes)

Only the SHA-256 hash of your key is stored server-side, so the full key is never recoverable — save it when it's generated.

## Using Your API Key

Include your API key in the `Authorization` header:

```bash theme={null}
Authorization: Bearer sk_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
```

### Example Request

```bash theme={null}
curl -X POST https://api.dashtray.app/api/v1/notifications/send \
  -H "Authorization: Bearer sk_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Hello",
    "body": "This is authenticated"
  }'
```

### JavaScript/Fetch

```javascript theme={null}
fetch('https://api.dashtray.app/api/v1/notifications/send', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    title: 'Hello',
    body: 'This is authenticated'
  })
});
```

### Python/Requests

```python theme={null}
import requests

headers = {
    'Authorization': 'Bearer sk_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6',
    'Content-Type': 'application/json'
}

response = requests.post(
    'https://api.dashtray.app/api/v1/notifications/send',
    headers=headers,
    json={
        'title': 'Hello',
        'body': 'This is authenticated'
    }
)
```

## Managing API Keys

### Generate a New Key

1. Go to [Dashboard → Settings → API Keys](https://web.dashtray.app/settings/api-keys)
2. Click **Generate New Key**
3. Enter a name (e.g., "Build Bot", "Cline Agent")
4. Copy the full key immediately (displayed only once)

### View Keys

Your API Keys page shows:

* **Key Preview** - First 16 characters (e.g., `sk_test_a1b2c3d4`) — the rest is hidden
* **Name** - Your custom name for the key
* **Created** - When the key was generated
* **Last Used** - When the key was last used (if at all)

### Revoke a Key

Click **Revoke** on any key to permanently disable it. Revoked keys:

* Stop working immediately
* Cannot be restored
* Should be regenerated if exposed

## Security Best Practices

<Warning>
  Never commit API keys to version control. Use environment variables instead.
</Warning>

### Environment Variables

Store your API key in an environment variable:

```bash theme={null}
# .env (add to .gitignore)
DASHTRAY_API_KEY=sk_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
```

Access it in your code:

```javascript theme={null}
const apiKey = process.env.DASHTRAY_API_KEY;
```

### Key Rotation

Rotate your API keys periodically:

1. Generate a new key
2. Update your application to use the new key
3. Revoke the old key after confirming everything works

### Exposed Key

If a key is exposed:

1. **Revoke immediately** in the dashboard
2. **Generate a new key**
3. **Update your application** with the new key
4. Monitor your account for unusual activity

## Rate Limiting

Rate limits are based on your plan and applied per API key, per minute:

| Plan | Requests / minute |
| - | - |
| Starter | 100 |
| Pro | 1,000 |

When rate limited, you'll receive a `429 Too Many Requests` response with a `Retry-After: 60` header indicating when the window resets.

## Troubleshooting

**401 Unauthorized**

* Check the API key format (should start with `sk_`)
* Verify the `Authorization` header is set correctly
* Ensure the key hasn't been revoked

**429 Too Many Requests**

* You've exceeded your rate limit
* Wait for the limit to reset (see the `Retry-After` header)
* Upgrade your plan for higher limits


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.