Authentication

API Keys

REST API access is available on the Suite and Enterprise plans. Generate an API key in Settings → API → New Key. Each key is scoped to your organisation with granular permissions. Choose only the scopes the integration actually needs (e.g. orders:read for a read-only ERP sync).

Authentication Flow

The external API uses a two-step authentication flow. First, exchange your raw API key for a short-lived JWT (valid 1 hour). Then use that JWT on every subsequent API call.

Step 1: Exchange the API key for a token

POST /api/v1/auth/token
Content-Type: application/json

{
  "apiKey": "dpk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Response 200:
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 3600,
  "tenantId": "f7a3c1b2-4d5e-6f7a-8b9c-0d1e2f3a4b5c"
}

Step 2: Call the v2 API with the token

Include both the Authorization header (JWT from Step 1) and the X-Tenant-ID header (the tenantId returned in Step 1) on every request to /api/v2/**.

Request Headers

Authorization: Bearer {jwt_from_step_1}
Content-Type: application/json
X-Tenant-ID: {tenantId_from_step_1}

Rate Limits

• Rate limits are configured at the application level and applied uniformly across all API keys
• Rate limit headers are returned on every response: X-RateLimit-Remaining and X-RateLimit-Reset
• HTTP 429 is returned when the limit is exceeded. Retry after the X-RateLimit-Reset timestamp.
• Contact support to adjust the limit for high-volume integrations