# Authentication

Authenticate every request with a secret API key sent in the x-api-key header, from your server only.

Every Dolafy API request is authenticated with a secret API key. Dolafy resolves your organization from the key itself — you never pass an organization id.

## API keys

Create and revoke keys from your dashboard under **Developers → Keys**. Keys look like this:

```text
dlfy_live_<random_string>
```

- The **full key is shown only once**, at creation time. Store it in your secrets manager immediately; Dolafy keeps only a hash and a short prefix for display.
- Keys are scoped to your organization and to the products your organization has enabled.
- **Revoking a key takes effect immediately.** Revoked keys fail authentication on the next request.

## Sending the key

Pass your key in the `x-api-key` header on every request:

```http
GET /v1/banking/balance
x-api-key: dlfy_live_...
```

Do not reuse internal or dashboard headers — `x-api-key` is the only accepted authentication header for the public API.

## Call from your server

The API is designed to be called **server-side**:

- Browser CORS is disabled by default. Origins are only allowlisted by arrangement with Dolafy, so a public web page cannot call the API directly.
- Your API key is a secret. Never ship it in client-side code, mobile apps, or public repositories.
- **Allowlist your server IP.** Ask your account manager to add your outbound server IP address(es) to your organization's allowlist. Requests from unrecognized IPs may be blocked by Dolafy's edge security before they reach the API.

## Rate limits

Requests are rate limited per API key. The default authenticated limit is **600 requests per 15 minutes**. Some sensitive endpoints (such as card issuance and card-details reads) have additional, stricter limits.

If you exceed a limit, back off and retry after a short delay.

## Access control

An API key only works for a product while **both** of these are true:

- Your organization has **API access** enabled.
- Your organization has the **specific product** enabled (Banking, Cards, or Checkout).

If either is turned off, the relevant endpoints return a `403`. See [Errors & Idempotency](/docs/errors) for the exact codes.