Authentication

All DocIntell API endpoints require authentication using Bearer tokens. This page covers how to obtain, use, and manage your API keys.

API Key Format

DocIntell uses two types of API keys:

Key Type	Prefix	Purpose
Live	`dk_live_`	Production usage, billable
Test	`dk_test_`	Development and testing, free

API keys are 51 characters long: an 8-character prefix plus a 43-character base64-encoded token. Example:

dk_live_K7gNU3sdo-OL0wNhqoVWhr3g6s1xYv72ol_pe_Unols

Using Your API Key

Include your API key in the Authorization header of every request:

Authorization: Bearer dk_live_YOUR_API_KEY

curl -X GET https://api.docintell.com/v1/documents \
  -H "Authorization: Bearer dk_live_K7gNU3sdo-OL0wNhqoVWhr3g6s1xYv72ol_pe_Unols"

import requests

headers = {
    "Authorization": "Bearer dk_live_K7gNU3sdo-OL0wNhqoVWhr3g6s1xYv72ol_pe_Unols"
}

response = requests.get(
    "https://api.docintell.com/v1/documents",
    headers=headers
)

const response = await fetch('https://api.docintell.com/v1/documents', {
  headers: {
    'Authorization': 'Bearer dk_live_K7gNU3sdo-OL0wNhqoVWhr3g6s1xYv72ol_pe_Unols',
  },
});

req, _ := http.NewRequest("GET", "https://api.docintell.com/v1/documents", nil)
req.Header.Set("Authorization", "Bearer dk_live_K7gNU3sdo-OL0wNhqoVWhr3g6s1xYv72ol_pe_Unols")

client := &http.Client{}
resp, _ := client.Do(req)

Obtaining API Keys

Via Dashboard

Log in to app.docintell.com
Navigate to Settings → API Keys
Click Create API Key
Choose:
- Name: A descriptive name (e.g., “Production Server”, “CI/CD Pipeline”)
- Environment: Live or Test
Click Create

Your API key is only shown once upon creation. Copy it immediately and store it securely. If you lose your key, you’ll need to create a new one.

Via API

You can also create API keys programmatically:

curl -X POST https://api.docintell.com/v1/keys \
  -H "Authorization: Bearer dk_live_YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CI/CD Pipeline",
    "environment": "live"
  }'

Response:

{
  "key_id": "019370ab-1234-7def-8901-234567890abc",
  "name": "CI/CD Pipeline",
  "key_prefix": "dk_live_",
  "key": "dk_live_K7gNU3sdo-OL0wNhqoVWhr3g6s1xYv72ol_pe_Unols",
  "environment": "live",
  "created_at": "2025-12-03T10:30:00Z"
}

The key field contains the full API key and is only included in the creation response. Subsequent API calls will only show the masked key_prefix.

Best Practices

Store Keys Securely

Environment Variables

Store keys in environment variables, never in code.

export DOCINTELL_API_KEY="dk_live_..."

Secret Managers

Use AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault for production.

Never commit API keys to version control. Add .env files to your .gitignore.

Use Separate Keys per Environment

Environment	Key Type	Purpose
Development	`dk_test_`	Local development, no billing
Staging	`dk_test_`	Integration testing
Production	`dk_live_`	Customer-facing workloads

Rotate Keys Regularly

Create a new API key
Update your applications to use the new key
Monitor for any requests using the old key
Delete the old key once migration is complete

Listing API Keys

View all API keys for your tenant:

curl -X GET https://api.docintell.com/v1/keys \
  -H "Authorization: Bearer dk_live_YOUR_API_KEY"

Response:

{
  "keys": [
    {
      "key_id": "019370ab-1234-7def-8901-234567890abc",
      "name": "Production Server",
      "key_prefix": "dk_live_",
      "environment": "live",
      "is_active": true,
      "created_at": "2025-12-01T10:30:00Z",
      "last_used_at": "2025-12-03T15:45:00Z"
    }
  ]
}

For security, the full API key is never shown after creation. Only the prefix is displayed.

Error Responses

Missing API Key

{
  "error": "missing_api_key",
  "message": "Authorization header is required"
}

HTTP Status: 401 Unauthorized

Invalid API Key

{
  "error": "invalid_api_key",
  "message": "The provided API key is invalid or has been revoked"
}

HTTP Status: 401 Unauthorized

Malformed Authorization Header

{
  "error": "malformed_auth_header",
  "message": "Authorization header must use Bearer scheme"
}

HTTP Status: 401 Unauthorized

Tenant Isolation

Each API key is associated with a tenant. All resources (documents, jobs, webhooks) are scoped to your tenant and isolated from other customers. DocIntell uses Row-Level Security (RLS) at the database level to enforce strict tenant isolation. Even if a bug exists in the application logic, the database prevents cross-tenant data access.

Rate Limits

API keys are subject to per-tenant rate limits:

Operation	Limit	Window
Document Ingestion	100 documents	1 hour
Job Status Checks	1,000 requests	1 hour

Rate limit information is returned in response headers:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1701612000

See Rate Limits for more details.

Public Endpoints

The following endpoints do not require authentication:

Endpoint	Purpose
`GET /`	API info and version
`GET /health`	Health check
`GET /healthz`	Kubernetes-style health check

Getting Started

Core Concepts

Guides

SDKs & Examples

Resources

API Key Format

Using Your API Key

Obtaining API Keys

Via Dashboard

Via API

Best Practices

Store Keys Securely

Environment Variables

Secret Managers

Use Separate Keys per Environment

Rotate Keys Regularly

Listing API Keys

Error Responses

Missing API Key

Invalid API Key

Malformed Authorization Header

Tenant Isolation

Rate Limits

Public Endpoints

​API Key Format

​Using Your API Key

​Obtaining API Keys

​Via Dashboard

​Via API

​Best Practices

​Store Keys Securely

Environment Variables

Secret Managers

​Use Separate Keys per Environment

​Rotate Keys Regularly

​Listing API Keys

​Error Responses

​Missing API Key

​Invalid API Key

​Malformed Authorization Header

​Tenant Isolation

​Rate Limits

​Public Endpoints

API Key Format

Using Your API Key

Obtaining API Keys

Via Dashboard

Via API

Best Practices

Store Keys Securely

Use Separate Keys per Environment

Rotate Keys Regularly

Listing API Keys

Error Responses

Missing API Key

Invalid API Key

Malformed Authorization Header

Tenant Isolation

Rate Limits

Public Endpoints