Authentication

Every request carries an API key as a bearer token, sent from your server. Keys belong to your organisation, not to a person.

Get a key

In the Docgen console, open API keys and create one. The full key is shown once; we store only a hash, so if you lose it, create a new one and revoke the old one.

Keys start with their mode: dg_test_ or dg_live_. See Test vs live.

Send it

curl https://api.129.212.147.181.sslip.io/v1/usage \  -H "Authorization: Bearer $DOCGEN_API_KEY"

The only endpoint that takes no key is the signed download link in files.*.url: the link itself is the credential, and it expires.

Keep it secret

• Read it from the environment or a secret manager, never from source code.
• Use a separate key per environment and per service, so you can revoke one without touching the others.

Browsers are refused

Any request with an Origin header, which every browser sends on a cross-site call, gets 401 secret_key_in_browser, even with a valid key. Call the API from your server and have your pages call your server.

Your end users

The key says which organisation is calling. Session calls also say which of your users they are for, in Docgen-Subject, set from your own login. See Subjects.

When it fails

A missing header returns 401 key_missing; an unknown or revoked key returns 401 key_invalid; a call from a browser returns 401 secret_key_in_browser.