> ## Documentation Index
> Fetch the complete documentation index at: https://docs.docksys.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests and protect API keys.

Dock developer API endpoints use API-key authentication.

## API-key auth

Send your API key as a Bearer token.

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

<Warning>
  API keys must stay server-side. Do not place them in frontend JavaScript, mobile apps, public Git repositories, Discord messages, screenshots, or logs.
</Warning>

<CodeGroup>
  ```bash cURL theme={null}
  curl --request GET \
    --url "https://api.docksys.xyz/api/v1/public/roblox-to-discord?robloxId=156319135&guildId=987654321098765432" \
    --header "Authorization: Bearer YOUR_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    "https://api.docksys.xyz/api/v1/public/roblox-to-discord?robloxId=156319135&guildId=987654321098765432",
    {
      headers: {
        Authorization: `Bearer ${process.env.DOCK_API_KEY}`,
      },
    },
  );

  const payload = await response.json();
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.get(
      "https://api.docksys.xyz/api/v1/public/roblox-to-discord",
      params={"robloxId": "156319135", "guildId": "987654321098765432"},
      headers={"Authorization": f"Bearer {os.environ['DOCK_API_KEY']}"},
  )

  payload = response.json()
  ```
</CodeGroup>

## Key safety rules

<Steps>
  <Step title="Use one key per integration scope">
    Do not create extra keys to bypass quotas, restrictions, suspensions, or access controls.
  </Step>

  <Step title="Rotate compromised keys">
    If a key is exposed, revoke it and create a replacement from the dashboard.
  </Step>

  <Step title="Restrict trusted hosts">
    Use IP allowlists or denylists when a key should only run from known infrastructure.
  </Step>

  <Step title="Log safely">
    Log request IDs and status codes, not full API keys or sensitive account data.
  </Step>
</Steps>

## Common auth failures

<ResponseField name="INVALID_API_KEY" type="401">
  The Bearer token is missing, invalid, expired, revoked, or disabled.
</ResponseField>

<ResponseField name="PREMIUM_REQUIRED" type="403">
  The endpoint or requested expansion requires a Premium key.
</ResponseField>

```json Auth error theme={null}
{
  "status": 401,
  "error": "Unauthorized: Invalid API key",
  "version": "1.0.0",
  "timestamp": "2026-05-07T00:00:00.000Z"
}
```