API authentication#

Every /api/v1 request requires a Doctosan developer key. Send the plaintext secret in the X-API-Key request header:

GET /api/v1/key HTTP/1.1
Host: www.doctosan.com
Accept: application/json
X-API-Key: dct_live_replace_me

The validation endpoint returns non-secret key metadata:

{
  "key": {
    "id": "0f20b884-…",
    "name": "Outreach CRM",
    "prefix": "dct_live_Ab12cd…",
    "creationTime": "2026-09-20T10:00:00.000Z"
  }
}

The API also accepts Authorization: Bearer dct_live_… when it is reached without a gateway that owns that header. X-API-Key is the canonical REST form and works through www.doctosan.com.

Secret lifecycle#

• The full secret is returned only by the create-key operation in the web console.
• Doctosan stores a SHA-256 hash, not a recoverable copy.
• A Doctosan account may hold at most five active keys.
• Revocation takes effect on the next request.
• Use a separate key for each workload so one integration can be rotated without interrupting another.

Errors#

Do not retry a 401. On 429, wait for the number of seconds in Retry-After. Successful authenticated responses include RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, and RateLimit-Policy headers.

Do not send keys in URLs

Query strings are routinely retained by browsers, proxies, analytics, and access logs. Credentials belong in a header only.