Authentication

Overview

DMTR supports API keys for server-to-server integrations and OAuth 2.0 for user-delegated access. Service accounts use API keys or client credentials. Choose the method that matches your use case and security requirements.

API keys

Create API keys in the DMTR dashboard under Settings > API Keys. Keys are scoped to an environment (production or sandbox) and can be restricted by permission. Rotate keys periodically via the dashboard; old keys remain valid until revoked or expired.

Auth header pattern

Every authenticated request must include the Authorization header with a Bearer token. Both API keys and OAuth access tokens use this format:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxx
Content-Type: application/json

curl -X GET "https://api.dmtr.ai/v1/positions" \
  -H "Authorization: Bearer $DMTR_API_KEY" \
  -H "Content-Type: application/json"

OAuth 2.0 flow

Use the authorization code flow with PKCE for web and mobile applications. Redirect users to the authorization endpoint, exchange the code for tokens, and use the access token in the Authorization header. Refresh tokens extend sessions without re-prompting the user.

Service accounts

Service accounts are non-human identities for automated workflows and batch jobs. Create them in the dashboard and assign explicit permission sets. Authenticate with API keys or client credentials (client_id + client_secret) depending on your integration pattern.

Token format

Access tokens are JWT Bearer tokens. Include them in the Authorization header as Bearer <token>. API keys are opaque strings used the same way. Tokens expire; implement refresh logic or use long-lived API keys for server-side use.

Scopes

OAuth scopes control which resources and actions an access token can perform. Common scopes include positions:read, positions:write, registry:read, and webhooks:manage. Request only the scopes you need; least-privilege applies.

Best practices

Store API keys and secrets in secure vaults; never commit them to source control. Use least-privilege permissions. Rotate credentials on a schedule and immediately if compromise is suspected. Prefer OAuth for user-facing apps and API keys for backend services.