# Authentication

Generate a key in the panel and send it on every request. Keys carry full account access, so treat them as secrets.

Every endpoint requires a key. There is no public or unauthenticated route.

## Getting a key

- Open the API page. In the panel.

- Create a key. It is shown once, in full, at that moment.

- Store it somewhere safe. It is never displayed in full again.

Keys look like `dt_` followed by 44 hex characters. You can hold up to five active keys at
once, and revoking one takes effect immediately.

## Sending the key

Either header works. Pick one and use it consistently.

```
X-API-Key: dt_your_key_here
```

```
Authorization: Bearer dt_your_key_here
```

### curl

```
curl -s https://www.dextrending.net/api/v1/packages \
  -H "X-API-Key: $DT_KEY"
```

### JavaScript

```
const res = await fetch("https://www.dextrending.net/api/v1/packages", {
  headers: { "X-API-Key": process.env.DT_KEY }
});
const { packages } = await res.json();
```

### Python

```
import os, requests

r = requests.get(
    "https://www.dextrending.net/api/v1/packages",
    headers={"X-API-Key": os.environ["DT_KEY"]},
    timeout=30,
)
r.raise_for_status()
packages = r.json()["packages"]
```

### PHP

```
$ch = curl_init("https://www.dextrending.net/api/v1/packages");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ["X-API-Key: " . getenv("DT_KEY")],
]);
$packages = json_decode(curl_exec($ch), true)["packages"];
```

## What a key can do

A key has the same reach over your account as being signed in: it can read your packages and
campaigns, and it can spend packages by launching campaigns. Treat it as a secret.

- Keep keys in environment variables, never in committed source

- Never put a key in front-end code — anyone loading the page can read it

- Use separate keys per integration so one can be revoked without breaking the others

- Revoke immediately if a key is exposed

A key cannot change your wallet, withdraw anything, or buy packages. The worst an exposed key does is
read your data and burn packages you already own — which is bad enough to act on quickly.

## Revoking

Revoke from the same panel page. It takes effect on the next request, and campaigns already launched
with that key are unaffected.

## Authentication failures

| Status | Body | Cause |
| ------ | ---------------------------- | --------------------------------------------------- |
| `401` | Missing or malformed API key | No header, or the key is not in `dt_` + 44 hex form |
| `401` | Invalid or revoked API key | Correct shape, but not an active key |
| `403` | Account suspended | The account behind the key is not active |

## Questions

**Where do I get an API key?**

From the API page in the panel. It is shown once in full when created and never displayed again, so store it immediately.

**How many keys can I have?**

Up to five active at once. Revoke one to free a slot.

**Can a stolen key move my funds?**

It cannot withdraw anything or buy packages. It can read your data and spend packages you already hold by launching campaigns, so revoke it immediately if exposed.

**Which header should I use?**

Either X-API-Key or Authorization: Bearer. They are equivalent; pick one and stay consistent.