Authenticate every API request with a Bearer token API key from your dashboard.
Every request to the OpenDunes API must carry an API key. Keys are scoped to your account and control access, rate limits, and billing.
Pass your key in the Authorization header as a Bearer token:
Always store your key in an environment variable — never hardcode it in source files or commit it to version control.
Keys follow the format sk- followed by a hex string, for example sk-0a1b2c3d4e5f6a7b8c9d.... The full key is shown once at creation time. After that only a hash is stored, so there is no way to retrieve the original value — only rotate it.
Go to your dashboard. A default key is created automatically when you sign up — you can use it immediately.
From that page you can:
A key can carry a cap on what it may spend — a total, or an amount that resets daily, weekly or
monthly. Once a key reaches its cap, its requests answer 402 with error: "key_limit_exceeded",
while your other keys keep working.
The cap is a guard rail, not an accounting boundary: usage is measured just after each request completes, so a burst can carry a key slightly past its cap before it closes. Your account balance remains the exact limit.
Pausing switches a key off and keeps everything else about it — same key, same settings — so you can switch it back on later. Revoking is permanent: the key can never be reactivated, and you would need to issue a new one and update whatever was using it.
Keys can also be created programmatically via POST /api/keys using a session-authenticated request (from your own app's backend, for example).
Rotate or delete the key immediately at /dashboard/keys. A rotation issues a new key and invalidates the old one in a single atomic step — in-flight requests complete, but new requests with the old key return 401 invalid_api_key.
If you suspect unauthorized usage, check /dashboard/analytics for an itemized request log filtered by key.