Authentication

The API uses your organization's API keys, the same keys your middleware uses. Beyond GET /me, a key reaches nothing until an owner or admin grants it access.

Create a key with access

1. In the dashboard, open API keys.
2. Enter a Key name and choose when it Expires.
3. Under DNS records, choose Read records or Edit records, then All domains (including domains you connect later) or Only the ones I pick.
4. Under Reports, tick Read usage, Read earnings, or both. Read earnings appears once D3 turns on prices and human verification for your organization.
5. Click Create key. The key is shown once: copy it into your secret manager.

To change a key's access later, click Permissions on it.

A change made with a key is made in the name of the person who granted its access.

Authenticate

Send the key over HTTPS in the Authorization header, after Bearer . A key sent over plain HTTP is refused and loses its API access, so an owner or admin has to grant it again.

GET /me answers any key with what it can reach:

curl https://api.d3.com/v1/me \
  -H "Authorization: Bearer $DNA_API_KEY"

{
  "id": "6b1f0e9a-3c2d-4e8f-9a71-2d5c8b0e4f13",
  "name": "deploy script",
  "prefix": "d3_k_7Qm2xRa…k4Pz",
  "organization_id": "Xc81LwQ0pTz5vNk2aR7yHd3e",
  "expires_at": null,
  "grants": [
    {
      "permission": "dns:edit",
      "resource": { "type": "domain", "all": true },
      "granted_by": "ana@example.com",
      "granted_at": "2026-10-20T14:02:11.000Z"
    },
    {
      "permission": "usage:read",
      "resource": { "type": "organization", "all": true },
      "granted_by": "ana@example.com",
      "granted_at": "2026-10-20T14:02:11.000Z"
    }
  ],
  "lapsed": []
}

A key reaches only your organization, and only what its access names.

When a key loses access

A key's API access ends when an owner or admin removes it, or on its own for the reasons below. The key keeps working for your middleware unless it is revoked. Access never comes back by itself: an owner or admin grants it again.

GET /me lists access the key lost in the last 30 days under lapsed, with one of these reasons:

A key whose creator is no longer an owner or admin can't be given access again: create a new key.