Authentication

DocLD uses API keys for programmatic access and session-based authentication for the dashboard. Create and manage keys in the dashboard (see API Keys). See API Reference Overview for base URL and rate limits.

API Key Authentication

Include your API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Creating API Keys

1. Go to Settings → API Keys
2. Click “Create API Key”
3. Copy the key immediately (shown only once)
4. Store securely - treat it like a password

API Key Properties

Rotating Keys

Rotate API keys periodically for security: in the dashboard go to Settings → API Keys, select the key, and click Rotate. This generates a new key and invalidates the old one. The new key is shown only once.

Session Authentication

The dashboard uses secure HTTP-only cookies for session authentication via Supabase Auth.

Session authentication is required for:

• Settings and profile management
• Billing operations
• GDPR consent management
• Security-sensitive operations

Organization Context

API keys can be scoped to an organization. When using an org-scoped key:

• All created resources belong to that organization
• Access is limited to organization resources
• organization_id parameter is automatically applied

Rate Limiting

Rate limits vary by tier:

Rate Limit Headers

Responses include rate limit information:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 55
X-RateLimit-Reset: 1705322400

Handling Rate Limits

When rate limited, you’ll receive a 429 Too Many Requests response:

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded. Try again in 60 seconds.",
    "retry_after": 60
  }
}

Security Best Practices

1. Never expose keys in client-side code or version control
2. Use environment variables for key storage
3. Rotate keys regularly (every 90 days recommended)
4. Use organization-scoped keys for team access
5. Set expiration dates for temporary access
6. Monitor usage via the dashboard

Error Responses

See also: API Keys, Overview.