Authentication

Every request to the OpenDunes API carries a key. There are two kinds:

An expired or disabled key, or a key sent to a route of the other kind, gets a 401.

Using an API key#

Send the key as a Bearer token:

Authorization: Bearer $OPENDUNES_API_KEY

or in x-api-key, as the Anthropic library sends it:

x-api-key: $OPENDUNES_API_KEY

Keep the key in an environment variable — never in source files or version control. The full key is shown once, when it is created; only a hash is kept, so a lost key is replaced, never recovered.

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://opendunes.com/v1",
    api_key=os.environ["OPENDUNES_API_KEY"],
)

resp = client.chat.completions.create(
    model="anthropic/claude-sonnet-5",
    messages=[{"role": "user", "content": "Marhba!"}],
)
print(resp.choices[0].message.content)

The Anthropic library takes https://opendunes.com as its base URL and sends the key in x-api-key on its own.

Where to get a key#

Go to your dashboard. A default key is created when you sign up, and you can use it at once. From there you can create more keys, pause one (reversible), revoke one (not), or regenerate one — a new key replaces the old in one step.

What is set on an API key#

A day, a week and a month are Algeria time; the week starts on Monday. A spent cap stops that key with a 402 (limit_source: "key") while your other keys keep running, and a request admitted under the cap settles in full, even past it. A key reads its own cap and spend at GET /v1/key.

There is no cap on the number of requests a key sends — see Limits.

Management keys#

Create one at Settings → Management keys. Its expiry is fixed when it is created and cannot be changed afterwards.

With a management key you can create and manage API keys from your own code:

curl https://opendunes.com/v1/keys \
  -H "Authorization: Bearer $OPENDUNES_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Souk Bot", "limit": 2000, "limit_reset": "monthly" }'

The answer carries the new key once, and its hash — the handle GET · PATCH · DELETE /v1/keys/{hash} take. See the API keys reference.

Keys for other apps#

An app can get an API key on its user's wallet, with the user's approval — see Sign in with OpenDunes.

If your key is exposed#

Regenerate or delete it at once at /dashboard/keys. A regenerated key replaces the old one in a single step; requests with the old key answer 401 from then on.

If you suspect unauthorised use, check /dashboard/activity for every request, filtered by key.