API keys

How keys work

• Format. Every key looks like dq_live_… and is unique to a single user.
• Access. A key inherits its owner’s knowledge-base access — the KBs they own plus any shared with them read-only. There is nothing extra to configure.
• Shown once. The full value is displayed only at creation time. If you lose it, revoke the key and create a new one.
• Transport. Always send the key over HTTPS in the Authorization header as a Bearer token.

Sending the key

Add an Authorization: Bearer <key> header to every request. Read the key from the environment rather than hard-coding it.

# Send your key as a Bearer token on every request
curl http://localhost:3000/api/v1/me \
  -H "Authorization: Bearer dq_live_xxxxxxxxxxxxxxxxxxxx"

# In Node.js
fetch("http://localhost:3000/api/v1/me", {
  headers: { Authorization: `Bearer ${process.env.DOCUQ_API_KEY}` }
})

Error responses

Auth failures use the uniform error envelope. A missing or invalid key returns 401 unauthorized; a valid key without access to a requested resource returns 403 forbidden.

401 — missing or invalid key

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key."
  }
}

403 — key valid but not permitted

{
  "error": {
    "code": "forbidden",
    "message": "Your key does not have access to this knowledge base."
  }
}

Security best practices