Skip to main content

​
REST API keys

Approved users can create and revoke keys in the Datalayer dashboard. Send the key in every API request:
Production keys begin with dl_live_; staging keys begin with dl_test_. Use a key only with its matching environment. A production key does not activate billing or create an allowance. Your account is determined by the credential; do not send an account ID to select another account. Use GET https://api.datalayer.so/v1/auth to check a key without consuming profiles. A valid key returns {"authenticated":true}. Missing, invalid or revoked keys return HTTP 401. Store keys in a secret manager or private environment variables. Do not put them in URLs, screenshots, support messages, public repositories or browser-side code. Revoke an exposed key in the dashboard.

​
MCP authorization

Compatible MCP clients can use browser-based OAuth sign-in. Authorize the Datalayer connection using the same account as your dashboard. Alternatively, a client with private Bearer-header support can use a Datalayer API key. Dashboard session cookies are not REST API credentials. Follow the MCP setup guide for the hosted endpoint and current connection limitations.

​
Access during private preview

Public signup is restricted. An installation link or API key does not by itself provide data access. Searches and lookups need an active allowance, even if authentication and tool discovery succeed.