Authentication
Every data endpoint needs an API key. Create one on your dashboard and send it in a header.
An account is a username and a password, nothing else. No email, no card. Every account starts on the Free plan and can upgrade to Pro from the dashboard at any time.
- Usernames are 3 to 20 letters, digits or underscores.
- Passwords are at least 8 characters.
- One account can be created per network.
There is no password reset
Accounts have no email address, so a forgotten password cannot be recovered. Save it in a password manager when you sign up. Your keys keep working either way, but you will not be able to manage them or your plan without the password.
A key is ds_ followed by 32 letters, digits, dashes and underscores, for example ds_4fQx0b9cJ1vW2kTq8LmNa7Ry3PzE5dHs (not a real key). Create up to 5 keys on your dashboard. The full key is shown once, when you create it. After that the dashboard only shows its first characters, so copy it straight away.
All keys on an account share its plan and its limits. Use one key per app: when an app is retired or a key leaks, revoke that key on the dashboard and the rest keep working.
Send the key in the x-api-key header. A standard bearer token in Authorization works too. Keys in the URL are never accepted, so they do not end up in logs and browser history.
curl "https://api.donutstats.io/v1/status" \
-H "x-api-key: $DONUTSTATS_API_KEY"A few endpoints need no key: GET /health for uptime checks, GET /v1, the endpoint index, and the image endpoints.
Keys you create on the dashboard have both of the first two scopes.
Treat a key like a password. Anyone who has it can spend your limits. Call the API from your server, cache what you get back and serve your own users from that cache.
Do not put keys in browser code
The API does not send CORS headers to other websites, so browsers block calls made straight from a web page, and anything shipped to a browser can be read by its users anyway. Backends, scripts and Discord apps are the right place for a key.