Authentication

What this is

Every request carries the key as a bearer token:

Authorization: Bearer ds_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

There are exactly two scopes: read (always present on any key) and write (create posts, upload media, retry, cancel). A route that needs write on a read-only key answers 403 insufficient_scope.

Key and session together

Sending an API key and a signed-in browser session’s cookie on the same request is rejected as key_and_session (401) rather than silently picking one - an ambiguous credential is treated as none.

Common errors

Error	Cause	Fix
unauthenticated	No key or session sent, or the key is invalid/revoked.	Send a valid key in the Authorization header.
insufficient_scope	The key lacks the scope the route needs.	Create a key with write, or use this key only for read routes.
key_and_session	Both a key and a session cookie were sent on the same request.	Send only one - a key for a script or integration, a session for the browser.