> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dohoo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Authenticate Dohoo API Requests with API Keys

> Use the X-API-Key header to authenticate every Dohoo REST API request. Learn how to retrieve, use, and rotate your API key programmatically.

Every request you make to the Dohoo API must be authenticated with an API key. Dohoo uses a simple header-based scheme — include your key in the `X-API-Key` request header and the API will identify your account, validate your plan, and enforce your usage limits automatically.

## Getting your API key

<Steps>
  <Step title="Log in to your Dohoo account">
    Go to [dohoo.ai](https://dohoo.ai) and sign in. API access requires a Business or Agency plan.
  </Step>

  <Step title="Navigate to API Keys">
    Open **Settings → API Keys** in the dashboard. Your key is displayed there and ready to copy.

    Alternatively, you can retrieve your key programmatically:

    ```bash theme={null}
    curl -X GET https://dohoo.ai/api/user/api-key \
      -H "X-API-Key: dh_live_xxxxxxxxxxxxxxxxxxxxxxxx"
    ```
  </Step>

  <Step title="Copy your key">
    Your API key always starts with the prefix `dh_live_`. Copy it and store it somewhere secure — you'll pass it as a header in every API request.
  </Step>
</Steps>

## Including the key in requests

Add the `X-API-Key` header to every API call. The example below lists all uploaded files:

```bash theme={null}
curl -X GET https://dohoo.ai/api/upload/files \
  -H "X-API-Key: dh_live_xxxxxxxxxxxxxxxxxxxxxxxx"
```

The key format is always:

```
dh_live_xxxxxxxxxxxxxxxxxxxxxxxx
```

If you omit the header or supply an invalid key, the API returns `401 Unauthorized`.

## Rotating your API key

You can rotate your API key at any time — either from the dashboard or via the API itself. Rotating generates a new key and immediately invalidates the old one.

**Via the API:**

```bash theme={null}
curl -X POST https://dohoo.ai/api/user/api-key \
  -H "X-API-Key: dh_live_xxxxxxxxxxxxxxxxxxxxxxxx"
```

**Via the dashboard:**

Go to **Settings → API Keys → Rotate** and confirm the action.

<Warning>
  Rotating your API key **immediately invalidates the old one**. Any integration still using the previous key will start receiving `401 Unauthorized` errors. Update all your integrations with the new key before or immediately after rotating.
</Warning>

## Storing your key safely

<Tip>
  Store your API key as an environment variable so it never appears in your source code or version control history.

  ```bash theme={null}
  export DOHOO_API_KEY="dh_live_xxxxxxxxxxxxxxxxxxxxxxxx"
  ```

  Then reference it in your requests:

  ```bash theme={null}
  curl -X GET https://dohoo.ai/api/upload/files \
    -H "X-API-Key: $DOHOO_API_KEY"
  ```
</Tip>