Authenticate every API request with a Bearer token API key from your dashboard.
Every request to the OpenDunes API must carry an API key. Keys are scoped to your account and control access, rate limits, and billing.
Pass your key in the Authorization header as a Bearer token:
Always store your key in an environment variable — never hardcode it in source files or commit it to version control.
Keys follow the format sk- followed by a hex string, for example sk-0a1b2c3d4e5f6a7b8c9d.... The full key is shown once at creation time. After that only a hash is stored, so there is no way to retrieve the original value — only rotate it.
Go to your dashboard. A default key is created automatically when you sign up — you can use it immediately.
From that page you can:
Keys can also be created programmatically via POST /api/keys using a session-authenticated request (from your own app's backend, for example).
Rotate or delete the key immediately at /dashboard/keys. A rotation issues a new key and invalidates the old one in a single atomic step — in-flight requests complete, but new requests with the old key return 401 invalid_api_key.
If you suspect unauthorized usage, check /dashboard/analytics for an itemized request log filtered by key.