API Keys & Headers

Learn how to get your API keys and make authenticated requests to the Dakota Platform API.

Getting Your API Keys

Step 1: Access the Dakota Dashboard

To get an API key, you first need access to the Dakota Platform dashboard:

Environment	Dashboard URL
Production	platform.dakota.xyz
Sandbox	platform.sandbox.dakota.xyz

New to Dakota? If you don’t have a Dakota account yet, contact our sales team to get started. Once your account is set up, you’ll receive credentials to access the dashboard.

Step 2: Create an API Key

Log into your Dakota Platform dashboard
Navigate to the API Keys section in the sidebar
Click Create New API Key
Give your key a descriptive name (e.g., “Production Server”, “Development Testing”)
Copy and store the key securely — it will only be shown once

API keys are only displayed once when created. Store them securely in your environment variables or secrets management system. If you lose your key, you’ll need to create a new one.

API Key Format

API keys are base64-encoded strings with exactly 60 characters, for example:

AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=

API Base URLs

Once you have your API key, use it with the corresponding API base URL:

Environment	API Base URL	Use Case
Sandbox	`https://api.platform.sandbox.dakota.xyz`	Development and testing
Production	`https://api.platform.dakota.xyz`	Live transactions

Start with Sandbox — We recommend building and testing your integration in the sandbox environment first. Sandbox uses simulated data and won’t process real transactions.

Required Headers

All API requests require the x-api-key header for authentication:

x-api-key: AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=

Mutating Requests: x-idempotency-key

The x-idempotency-key header is required for POST, PUT, and PATCH requests to ensure request idempotency:

x-idempotency-key: 550e8400-e29b-41d4-a716-446655440000

Use a unique UUID for each logical operation
Include this header on POST, PUT, and PATCH requests; do not include it on GET or DELETE requests
The key is cached for 24 hours. A reused key inside that window returns the original response, so no duplicate operation is created
Only successful responses are cached, so a failed request stays retryable under the same key

Content-Type Header

For requests with a body (POST, PUT, PATCH), include:

Content-Type: application/json

Making Authenticated Requests

GET Request Example

GET requests only need the API key header:

cURL

curl -X GET https://api.platform.dakota.xyz/customers \
  -H "x-api-key: AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=" \
  -H "Content-Type: application/json"

JavaScript

const response = await fetch('https://api.platform.dakota.xyz/customers', {
  headers: {
    'x-api-key': 'AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=',
    'Content-Type': 'application/json'
  }
});

Python

import requests

response = requests.get(
    'https://api.platform.dakota.xyz/customers',
    headers={
        'x-api-key': 'AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=',
        'Content-Type': 'application/json'
    }
)

package main

import (
    "net/http"
)

func main() {
    client := &http.Client{}
    req, _ := http.NewRequest("GET", "https://api.platform.dakota.xyz/customers", nil)

    req.Header.Add("x-api-key", "AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=")
    req.Header.Add("Content-Type", "application/json")

    resp, _ := client.Do(req)
    defer resp.Body.Close()
}

Rust

use reqwest::header::{HeaderMap, HeaderValue};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = reqwest::Client::new();

    let mut headers = HeaderMap::new();
    headers.insert("x-api-key", HeaderValue::from_static("AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc="));
    headers.insert("Content-Type", HeaderValue::from_static("application/json"));

    let response = client
        .get("https://api.platform.dakota.xyz/customers")
        .headers(headers)
        .send()
        .await?;

    Ok(())
}

Java

import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.net.URI;

public class DakotaGetExample {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.platform.dakota.xyz/customers"))
            .header("x-api-key", "AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=")
            .header("Content-Type", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = client.send(request,
            HttpResponse.BodyHandlers.ofString());
    }
}

POST Request Example

POST requests require both the API key and idempotency key headers:

cURL

curl -X POST https://api.platform.dakota.xyz/customers \
  -H "x-api-key: AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=" \
  -H "x-idempotency-key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name": "Acme Corp", "customer_type": "business"}'

JavaScript

const response = await fetch('https://api.platform.dakota.xyz/customers', {
  method: 'POST',
  headers: {
    'x-api-key': 'AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=',
    'x-idempotency-key': crypto.randomUUID(),
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'Acme Corp',
    customer_type: 'business'
  })
});

Python

import requests
import uuid

response = requests.post(
    'https://api.platform.dakota.xyz/customers',
    headers={
        'x-api-key': 'AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=',
        'x-idempotency-key': str(uuid.uuid4()),
        'Content-Type': 'application/json'
    },
    json={
        'name': 'Acme Corp',
        'customer_type': 'business'
    }
)

package main

import (
    "bytes"
    "net/http"
    "github.com/google/uuid"
)

func main() {
    client := &http.Client{}
    body := bytes.NewBufferString(`{"name": "Acme Corp", "customer_type": "business"}`)
    req, _ := http.NewRequest("POST", "https://api.platform.dakota.xyz/customers", body)

    req.Header.Add("x-api-key", "AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=")
    req.Header.Add("x-idempotency-key", uuid.New().String())
    req.Header.Add("Content-Type", "application/json")

    resp, _ := client.Do(req)
    defer resp.Body.Close()
}

Rust

use reqwest::header::{HeaderMap, HeaderValue};
use uuid::Uuid;
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = reqwest::Client::new();

    let mut headers = HeaderMap::new();
    headers.insert("x-api-key", HeaderValue::from_static("AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc="));
    headers.insert("x-idempotency-key", HeaderValue::from_str(&Uuid::new_v4().to_string())?);
    headers.insert("Content-Type", HeaderValue::from_static("application/json"));

    let body = json!({
        "name": "Acme Corp",
        "customer_type": "business"
    });

    let response = client
        .post("https://api.platform.dakota.xyz/customers")
        .headers(headers)
        .json(&body)
        .send()
        .await?;

    Ok(())
}

Java

import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.net.URI;
import java.util.UUID;

public class DakotaApiExample {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();

        String body = """
            {
              "name": "Acme Corp",
              "customer_type": "business"
            }
            """;

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.platform.dakota.xyz/customers"))
            .header("x-api-key", "AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=")
            .header("x-idempotency-key", UUID.randomUUID().toString())
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = client.send(request,
            HttpResponse.BodyHandlers.ofString());
    }
}

Header Summary

Header	Required For	Purpose
`x-api-key`	All requests	Authentication
`x-idempotency-key`	POST, PUT, PATCH	Prevent duplicate operations
`Content-Type`	Requests with body	Specify JSON content type

Remember: Include x-idempotency-key on POST, PUT, and PATCH requests. GET and DELETE requests should not include this header. The key must be a valid UUID.

Playground

Documentation

Import Share Tokens

Agentic Payments

Authentication

Developer Tools

API Keys & Headers

Getting Your API Keys

Step 1: Access the Dakota Dashboard

Step 2: Create an API Key

API Key Format

API Base URLs

Required Headers

Mutating Requests: x-idempotency-key

Content-Type Header

Making Authenticated Requests

GET Request Example

POST Request Example

Header Summary

​Getting Your API Keys

​Step 1: Access the Dakota Dashboard

​Step 2: Create an API Key

​API Key Format

​API Base URLs

​Required Headers

​Mutating Requests: x-idempotency-key

​Content-Type Header

​Making Authenticated Requests

​GET Request Example

​POST Request Example

​Header Summary

Getting Your API Keys

Step 1: Access the Dakota Dashboard

Step 2: Create an API Key

API Key Format

API Base URLs

Required Headers

Mutating Requests: x-idempotency-key

Content-Type Header

Making Authenticated Requests

GET Request Example

POST Request Example

Header Summary