Skip to main content
Every call needs your access key, except /v1/health.

Send the key in a header

X-API-Key: DD-… works too, if your tool cannot set Authorization.

One key for everything

DisDog accounts have no password. When you create your account you get one access key, and it does two jobs:
  • it is your login on dis.dog,
  • it is your API key.
It is DD- followed by five groups of five characters (letters and digits, 125 random bits). DisDog is forgiving about how you send it: case does not matter, the dashes and spaces are optional, and the DD prefix can be left out. These all reach the same account:
DisDog checks your key against a keyed hash, and keeps an encrypted copy (AES-256-GCM) only so you can show it again: on your account page it is blurred by default, one click shows or copies it.

Get a new key

You have one key at a time. There are two ways to replace it: Then update the key wherever you use it.
If your key may have leaked — pushed to a repository, pasted in a chat, logged by a proxy — replace it right away. Until you do, anyone holding it can search with your quota and sign in to your account.

Keep it private

  • Your key is personal, like a password. Do not share it.
  • Keep it on a server or in your own scripts, in an environment variable or a secret manager, never in your source code.
  • Send it in a header, never in the URL: URLs end up in logs, browser history and proxies.
  • The API answers browsers from any site (that is how the playground in these docs works). Do not put your key in a web page or an app other people use: anyone who can read the page can read the key. Call the API from your backend.

Plans

The API comes with the Hound and Alpha plans. On Pup (free), the key works for /v1/me and /v1/modules only; every other route answers 403 plan_has_no_api. When a paid plan ends after its 30 days, the account goes back to Pup: your key keeps working on the website, and on the API for those two routes. Limits per plan →

Authentication errors