Keys and authorization

Every API request is signed with a key that looks like dtk_….

How to pass the key

In the Authorization header:

Authorization: Bearer dtk_your_key

or in the X-API-Key: dtk_your_key header.

Who owns the key

A key belongs to an organization: its plan, limits and the private channels it has verified. An organization has as many keys as its plan allows: Test — 1, Start — 2, Growth — 5, Profi — 20.

Key permissions

When creating a key on the “API keys” page you can tick “Read and write”. Without it the key only reads data — enough for every method except webhook management. Only a “read and write” key can create, change and delete webhooks; a key without the mark gets 403 read_only_key. The mark can’t be changed later — create another key.

The same key connects the MCP server for AI assistants: the assistant uses requests just like your code.

When a key stops working

• The key was revoked on the “API keys” page.
• The member was removed from the organization — their keys are revoked.
• The member is paused (not enough seats on the plan) or the organization is archived — keys are suspended and work again once access returns.