Authentication

The dOCR API authenticates every request with an API key sent as a Bearer token.

API keys

Create keys in the dashboard under Developers → API Credentials.

• A key is shown once, at creation. Copy it then; dOCR stores only a hash.
• Keys are prefixed docr_sk_ so they're easy to spot in code and logs.
• Revoke a key any time from the dashboard — revoked keys immediately stop working.

Authorizing a request

Send the key in the Authorization header:

curl https://app.docr.dev/api/v1/document-types \
  -H "Authorization: Bearer docr_sk_xxxxxxxxxxxxxxxxxxxxxxxx"

Requests with a missing or invalid key return 401:

{ "error": "Invalid or revoked API key" }

IP whitelisting

For an extra layer of security you can restrict API access to specific IP addresses or CIDR ranges, under Developers → IP Address Whitelist.

• When no entries exist, requests are accepted from any IP.
• When one or more entries exist, requests from any other IP are rejected with 403:

{ "error": "IP 203.0.113.4 is not whitelisted" }

Both exact IPv4 addresses (203.0.113.4) and CIDR ranges (203.0.113.0/24) are supported.

Keep keys secret

Treat API keys like passwords. Store them in environment variables or a secrets manager, never in client-side code or version control. Rotate keys periodically and revoke any that may have leaked.