curl --request POST \
--url https://api.platform.dakota.xyz/api-keys \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--header 'x-idempotency-key: <x-idempotency-key>' \
--data '
{
"name": "prod-payouts",
"scope": "operate"
}
'const options = {
method: 'POST',
headers: {
'x-idempotency-key': '<x-idempotency-key>',
'x-api-key': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: 'prod-payouts', scope: 'operate'})
};
fetch('https://api.platform.dakota.xyz/api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.platform.dakota.xyz/api-keys"
payload = {
"name": "prod-payouts",
"scope": "operate"
}
headers = {
"x-idempotency-key": "<x-idempotency-key>",
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.platform.dakota.xyz/api-keys"
payload := strings.NewReader("{\n \"name\": \"prod-payouts\",\n \"scope\": \"operate\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-idempotency-key", "<x-idempotency-key>")
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "1NFHrqBHb3cTfLVkFSGmHZqdDPi",
"key": "dk_live_4KLkSmzQbL6Xs8xnUjssdGHX7PfhHpAb",
"name": "prod-payouts",
"scope": "operate"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#invalid-request",
"title": "Invalid request",
"status": 400,
"detail": "Invalid request",
"instance": "https://api.platform.dakota.xyz/api-keys",
"request_id": "req_01hzy6y7v8w9x0y1z2a3b4c5d6"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#authentication-error",
"title": "Unauthorized",
"status": 401,
"detail": "Unauthorized",
"instance": "https://api.platform.dakota.xyz/api-keys",
"request_id": "req_01hzy6y7v8w9x0y1z2a3b4c5d6"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#forbidden",
"title": "Forbidden",
"status": 403,
"detail": "Forbidden",
"instance": "https://api.platform.dakota.xyz/api-keys",
"request_id": "req_01hzy6y7v8w9x0y1z2a3b4c5d6"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}Create a new API key
Generate a new API key. The key can do what its scope allows: full_access, operate or read_only. A key created without a scope has full access.
The key belongs to the client. It does not take the role of the person who created it, and it keeps working after that person is removed.
curl --request POST \
--url https://api.platform.dakota.xyz/api-keys \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--header 'x-idempotency-key: <x-idempotency-key>' \
--data '
{
"name": "prod-payouts",
"scope": "operate"
}
'const options = {
method: 'POST',
headers: {
'x-idempotency-key': '<x-idempotency-key>',
'x-api-key': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: 'prod-payouts', scope: 'operate'})
};
fetch('https://api.platform.dakota.xyz/api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.platform.dakota.xyz/api-keys"
payload = {
"name": "prod-payouts",
"scope": "operate"
}
headers = {
"x-idempotency-key": "<x-idempotency-key>",
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.platform.dakota.xyz/api-keys"
payload := strings.NewReader("{\n \"name\": \"prod-payouts\",\n \"scope\": \"operate\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-idempotency-key", "<x-idempotency-key>")
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "1NFHrqBHb3cTfLVkFSGmHZqdDPi",
"key": "dk_live_4KLkSmzQbL6Xs8xnUjssdGHX7PfhHpAb",
"name": "prod-payouts",
"scope": "operate"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#invalid-request",
"title": "Invalid request",
"status": 400,
"detail": "Invalid request",
"instance": "https://api.platform.dakota.xyz/api-keys",
"request_id": "req_01hzy6y7v8w9x0y1z2a3b4c5d6"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#authentication-error",
"title": "Unauthorized",
"status": 401,
"detail": "Unauthorized",
"instance": "https://api.platform.dakota.xyz/api-keys",
"request_id": "req_01hzy6y7v8w9x0y1z2a3b4c5d6"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#forbidden",
"title": "Forbidden",
"status": 403,
"detail": "Forbidden",
"instance": "https://api.platform.dakota.xyz/api-keys",
"request_id": "req_01hzy6y7v8w9x0y1z2a3b4c5d6"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}Authorizations
Headers
Unique key (UUID) to ensure request idempotency on POST, PUT and PATCH requests.
A key is scoped to your client, the HTTP method and the path, and is remembered for 24 hours after a
successful (below 400) response. Repeating the same request (same JSON body, whatever the key order or
whitespace) with the same key within that window returns the original response with
X-Idempotent-Replayed: true instead of executing the request again. Using the same key on the same
endpoint with a different body returns 422 with problem type idempotency-key-reused; the request is
not executed. Error responses (4xx and 5xx) are not remembered, so a request refused for a fixable reason
can be corrected and retried under the same key. Request bodies that are not JSON (for example file
uploads) are not compared.
Body
A label that says what the key is for. No two live keys of a client share a name.
1 - 128"prod-payouts"
What the key can do. The scopes nest: read_only is inside operate, and operate is inside full_access.
full_access: everything that an admin of the client can do. A key created without a scope gets it.operate: moves money and runs daily operations, but cannot add recipients or destinations, delete anything, or manage users, keys, signers, policies, mandates or webhooks. Wallet transactions and scheduled payments can still pay an address that is not a saved destination. A wallet transaction needs signatures from the signers of the wallet, and the policies of the wallet apply to it. A scheduled payment goes out only when a mandate of the client covers it.read_only: reads only.
A key does not take the role of the person who created it.
full_access, operate, read_only "read_only"
Response
API key created successfully
KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform.
27^[0-9A-Za-z]{27}$"1NFHrqBHb3cTfLVkFSGmHZqdDPi"
The API key value (only shown once at creation)
"dk_live_4KLkSmzQbL6Xs8xnUjssdGHX7PfhHpAb"
A label that says what the key is for. No two live keys of a client share a name.
1 - 128"prod-payouts"
What the key can do. The scopes nest: read_only is inside operate, and operate is inside full_access.
full_access: everything that an admin of the client can do. A key created without a scope gets it.operate: moves money and runs daily operations, but cannot add recipients or destinations, delete anything, or manage users, keys, signers, policies, mandates or webhooks. Wallet transactions and scheduled payments can still pay an address that is not a saved destination. A wallet transaction needs signatures from the signers of the wallet, and the policies of the wallet apply to it. A scheduled payment goes out only when a mandate of the client covers it.read_only: reads only.
A key does not take the role of the person who created it.
full_access, operate, read_only "read_only"
Was this page helpful?

