Documentation/Authentication

Authentication

DevSecure Intelligence uses bearer API keys. Send the key in the Authorization header.

Authorization: Bearer dsec_test_...

Key formats

Test mode

Keys use the dsec_test_ prefix.

Live mode

Keys use the dsec_live_ prefix.

Keys include a high-entropy body and checksum. The checksum helps detect malformed keys before lookup.

Safe handling

  • Store keys in a secret manager, not source code.
  • Never send full keys to logs, analytics, email, or support tickets.
  • Rotate a key when it leaves the intended runtime boundary.
  • Treat browser-side usage as unsafe unless the key is a deliberately scoped public evaluation key.

Public endpoints

These endpoints do not require authentication:

  • GET /api/v1/health
  • GET /api/v1/status
  • GET /api/v1/kev
  • GET /api/v1/stats
  • GET /api/v1/trends
  • GET /api/v1/trends/scatter

For endpoint security details, see the API Reference.

Authenticated endpoints

Authenticated endpoints return 401 when the key is missing, malformed, revoked, suspended, or unknown.

For the full error schema, see API Reference: ErrorResponse.