Authentication

Create and manage keys at API keys. Key management requires a signed-in account with a verified email. Each key’s full value is shown once; DefDex stores its hash. Use a separate named key for each integration.

Authenticate requests

REST and MCP use an Authorization header:

Authorization: Bearer YOUR_PRIVATE_KEY

The base URL is https://app.defdex.io/api/v1. The SDKs and CLI read DEFDEX_API_KEY from your environment. Keep keys in a secret manager or private environment, not in query strings, source control, frontend bundles or logs.

Choose scopes

Keys default to data:read. No key permits direct edits to published data. Account identity comes from the key. An account can have up to 10 active keys. To rotate, create a replacement, update and verify the integration, then revoke the old key.

Rate limit

All keys on one account share 60 requests per minute. Going over returns 429 with a Retry-After header. Wait that long and retry. Using more keys does not raise the limit. Calls are also metered in credits; see Credits and limits.

Usage

Open API usage or call GET /api/v1/usage. It returns 30 days of requests grouped by day, endpoint and status. It is free. Admitted responses include X-Request-Id for support.