Skip to main content

​
Authentication

The v1 API accepts two API-key authentication methods:
  • x-api-key: <key>
  • Authorization: Bearer <key>
dejaVu keys generally use the pk_ and sk_ prefixes.

​
Public key

A pk_ key is intended for read operations.

​
Secret key

An sk_ key can be used for authorized read and write operations.

​
Unsupported usage

Do not send a key in the query string:
This form is not supported by the v1 API.

​
Device Flow

The Device Flow is intended for applications and devices that do not have a full browser. The general flow is:
  1. Request a device code.
  2. Present the user code or QR code to the user.
  3. Have the device approved in dejaVu.
  4. Exchange the device_code for an access token.
  5. Use the returned token as a Bearer token.
The approval operation requires an authenticated dejaVu session. See the Auth endpoints for the exact request and response formats.

​
Security

  • Never log API keys.
  • Never place a secret key in JavaScript executed in the browser.
  • Use HTTPS for every request.
  • If a key is compromised, revoke it and create a new one.