Authentication

The Demoboost Public API uses API keys for authentication. Each key is scoped to one organization.

Sending the Key

Pass your API key in the X-Api-Key header on every request:

curl https://open.demoboost.com/v1/users \
  -H "X-Api-Key: dmb_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ123456"

Alternatively, you can use the Authorization: Bearer header with the same key value:

curl https://open.demoboost.com/v1/users \
  -H "Authorization: Bearer dmb_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ123456"

Key Format

Every API key has the format:

dmb_<env>_<32 alphanumeric characters>

Segment	Example	Description
`dmb`	`dmb`	Fixed prefix identifying Demoboost keys
`<env>`	`live` or `test`	Environment the key belongs to
`<32 chars>`	`aBcDe…`	Cryptographically random secret

The key prefix is the first 12 characters (e.g., dmb_live_aBcD). It is safe to display and is returned by the List Keys endpoint. The prefix never changes and lets you identify keys without exposing the secret.

Secret Shown Once

When a key is created, the full secret is returned exactly once in the API response. Demoboost only stores a one-way hash of the secret — it cannot be recovered later.

Store the secret in a secrets manager (e.g., AWS Secrets Manager, Vault) immediately after creation. If you lose it, revoke the key and create a new one.

Key Lifecycle

Created — key is active and accepts requests.
Expired — keys can have an optional expiresAt date. After expiry, the key is rejected with 401.
Revoked — you can revoke a key via the dashboard or the DELETE /v1/auth/api-keys/{id} endpoint. Revocation is immediate and irreversible.

Authentication Errors

Status	Cause
`401`	Missing header, key not found, key expired, or key revoked
`403`	Public API not enabled for the organization

All error responses use the RFC 7807 Problem Details format:

{
  "type": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid or missing API key.",
  "requestId": "abc-123"
}