Authentication | docs.do.dev

Learn how to authenticate with the do.dev APIs.

API Keys

API keys are the primary authentication method for the do.dev APIs.

Creating an API Key

Navigate to Settings → API Keys
Click Create New Key
Give your key a name
Copy the key securely

API keys are shown only once. Store them securely.

Using API Keys

Include your API key in the Authorization header:

curl https://api.do.dev/v1/users/me \
  -H "Authorization: Bearer sk_live_xxxxx"

Key Types

Type	Prefix	Usage
Live	`sk_live_`	Production
Test	`sk_test_`	Development/Testing

OAuth 2.0

For user-facing applications, use OAuth 2.0:

Authorization Code Flow

Redirect user to authorization URL
User grants permission
Receive authorization code
Exchange code for access token

// Step 1: Build authorization URL
const authUrl = new URL('https://do.dev/oauth/authorize');
authUrl.searchParams.set('client_id', 'YOUR_CLIENT_ID');
authUrl.searchParams.set('redirect_uri', 'https://your-app.com/callback');
authUrl.searchParams.set('response_type', 'code');
authUrl.searchParams.set('scope', 'read write');

// Step 2: After user authorizes, exchange code
const response = await fetch('https://api.do.dev/oauth/token', {
  method: 'POST',
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: 'AUTH_CODE',
    client_id: 'YOUR_CLIENT_ID',
    client_secret: 'YOUR_CLIENT_SECRET',
    redirect_uri: 'https://your-app.com/callback',
  }),
});

const { access_token, refresh_token } = await response.json();

Scopes

Available permission scopes:

Scope	Description
`read`	Read-only access
`write`	Read and write access
`billing:read`	View billing info
`billing:write`	Manage billing

Token Management

Refresh Tokens

const response = await fetch('https://api.do.dev/oauth/token', {
  method: 'POST',
  body: JSON.stringify({
    grant_type: 'refresh_token',
    refresh_token: 'REFRESH_TOKEN',
    client_id: 'YOUR_CLIENT_ID',
    client_secret: 'YOUR_CLIENT_SECRET',
  }),
});

Revoking Tokens

await fetch('https://api.do.dev/oauth/revoke', {
  method: 'POST',
  body: JSON.stringify({
    token: 'ACCESS_TOKEN',
  }),
});

Security Best Practices

Never expose keys in client code
Use environment variables
Rotate keys regularly
Use minimum required scopes
Monitor API usage

On this page