API Keys | OpenDunes Docs

API keys authenticate your requests. They are prefixed with sk- and shown in full exactly once at creation — only a hash is stored. A default key is created automatically when you sign up.

Programmatic key management goes through /v1/keys. It authenticates with a management key (mk-…) — a separate credential from your API keys, created at Settings → Management Keys; an API key there answers 401. For interactive management, use the Keys page.

A key is named by its hash: the SHA-256 of the key, in lowercase hex. Every amount is in DA.

The Go client has no keys resource, so call the endpoints directly with net/http.

List keys#

req, _ := http.NewRequest("GET", "https://opendunes.com/v1/keys", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))

resp, err := http.DefaultClient.Do(req)
// resp body: { "data": [{ "hash", "name", "label", "disabled", "limit", "limit_remaining", "limit_reset", "usage", … }, ...] }

Active keys, 100 at a time; add ?offset=100 for the next page and ?include_disabled=true for the disabled ones.

Create a key#

body, _ := json.Marshal(map[string]any{
	"name":        "production-backend",
	"limit":       2000,      // optional spending cap in DA
	"limit_reset": "monthly", // optional: daily, weekly or monthly
})

req, _ := http.NewRequest("POST", "https://opendunes.com/v1/keys", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
req.Header.Set("Content-Type", "application/json")

resp, err := http.DefaultClient.Do(req)
// 201 — resp body: { "data": { "hash": "…", "name": "production-backend", … }, "key": "sk-…" }
// key is returned ONCE — store it in your secret manager now

Change a key#

body, _ := json.Marshal(map[string]any{"limit": 5000, "disabled": false})

req, _ := http.NewRequest("PATCH", "https://opendunes.com/v1/keys/"+hash, bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
req.Header.Set("Content-Type", "application/json")

resp, err := http.DefaultClient.Do(req)
// → { "data": { … the key, changed … } }

PATCH takes name, limit, limit_reset, storage and disabled. A disabled key answers 401 until it is enabled again.

Delete a key#

req, _ := http.NewRequest("DELETE", "https://opendunes.com/v1/keys/"+hash, nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))

resp, err := http.DefaultClient.Do(req)
// → { "deleted": true }

Requests with a deleted key answer 401. A hash that is not one of your keys is a 404.

Also see#