> ## Documentation Index
> Fetch the complete documentation index at: https://api.docs.dealmachine.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the DealMachine API

The DealMachine API uses API keys to authenticate requests. You can create keys via the [Developer Settings](https://dm-next.dealmachine.com/settings/developer) or by using the DealMachine CLI.

## API Key Format

API keys follow this format:

```
dm_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

* `dm_sk_` - DealMachine secret key prefix
* `live_` - All keys are live keys (no test environment)
* The remaining 32 characters are your unique key

<Note>
  All API keys are live. There is no test/sandbox environment. Be mindful when testing write operations.
</Note>

## Making Authenticated Requests

Include your API key in the `Authorization` header using the Bearer scheme:

```bash theme={null}
curl https://api.v2.dealmachine.com/v1/account \
  -H "Authorization: Bearer dm_sk_live_xxx"
```

## Request Headers

| Header          | Required | Description                                 |
| --------------- | -------- | ------------------------------------------- |
| `Authorization` | Yes      | Your API key in Bearer format               |
| `Content-Type`  | Yes\*    | `application/json` for request bodies       |
| `X-Request-Id`  | No       | Your own request ID for distributed tracing |

\* Required for POST, PUT, and PATCH requests with a body.

<CodeGroup>
  ```typescript TypeScript theme={null}
  const response = await fetch('https://api.v2.dealmachine.com/v1/account', {
    headers: {
      'Authorization': `Bearer ${process.env.DM_API_KEY}`,
      'Content-Type': 'application/json',
    },
  });

  const { data } = await response.json();
  ```

  ```python Python theme={null}
  import requests
  import os

  response = requests.get(
      'https://api.v2.dealmachine.com/v1/account',
      headers={'Authorization': f'Bearer {os.environ["DM_API_KEY"]}'}
  )

  data = response.json()['data']
  ```
</CodeGroup>

## OAuth Access Tokens

The API also supports OAuth 2.0 access tokens for third-party integrations:

```
dm_at_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

OAuth tokens have scoped access based on the permissions granted during authorization. See the [OAuth documentation](/api-reference/oauth/authorize) for details.

## Security Best Practices

<AccordionGroup>
  <Accordion title="Never expose keys in client-side code">
    API keys should only be used in server-side code. Never include them in JavaScript that runs in the browser, mobile apps, or any client-facing code.
  </Accordion>

  <Accordion title="Use environment variables">
    Store your API keys in environment variables, not in your codebase:

    ```bash theme={null}
    export DM_API_KEY=dm_sk_live_xxx
    ```
  </Accordion>

  <Accordion title="Rotate keys if compromised">
    If you suspect a key has been compromised, immediately revoke it in the Developer Settings and create a new one.
  </Accordion>

  <Accordion title="Use separate keys per integration">
    Create separate API keys for different integrations or environments so you can revoke one without affecting others.
  </Accordion>
</AccordionGroup>

## Getting an API Key

### CLI Authentication (Recommended)

The easiest way to authenticate is using the DealMachine CLI:

```bash theme={null}
npm install -g dealmachine
dm login
```

This opens your browser for secure device authorization and stores credentials locally at `~/.dealmachine/config.json`.

See the [CLI documentation](/cli/overview) for more details.

### From the App

You can also create API keys manually:

1. [Go to Developer Settings](https://dm-next.dealmachine.com/settings/developer)
2. Click "Create API Key"
3. Give it a descriptive name
4. Copy the key immediately (it won't be shown again)

### Revoking Keys

To revoke a key:

1. [Go to Developer Settings](https://dm-next.dealmachine.com/settings/developer)
2. Find the key you want to revoke
3. Click "Revoke"

<Warning>
  Revoked keys immediately stop working. Any requests using a revoked key will receive a `401 Unauthorized` error.
</Warning>