API keys
Personal and organization API keys for services, scripts and integrations.
API keys let non-browser callers act against Dylog. A key is never sent to backends directly. It is exchanged for a 15-minute JWT, so backends keep one verification path.
Two kinds
| Kind | Prefix | Created from | Acts as | JWT sub |
|---|---|---|---|---|
| Personal | dylog_ | Account → Security → API keys | The person, in a chosen organization | user id |
| Organization | dylog_org_ | Organization → Settings → API keys | The organization itself (service) | apikey:<key id> |
Organization keys need the apikey:create permission (owners, admins and staff). They require a name, may
carry free-form metadata, and can expire (1 to 365 days) or live until deleted.
Keys are shown once at creation. Accounts stores only a hash plus a display prefix.
Exchanging a key for a token
curl -H "x-api-key: dylog_org_…" https://accounts.dylog.ai/api/token
# personal keys must name the organization:
curl -H "x-api-key: dylog_…" "https://accounts.dylog.ai/api/token?org=ssd"The response is { "token": "<jwt>" }. Organization keys produce org_role: "service" and email: null.
A personal key produces the person's real role in that organization.
Errors: 401 invalid or expired key, 403 the key's organization does not match org (or the person is
not a member), 404 unknown organization.
Limits
| Kind | Requests per day | Notes |
|---|---|---|
| Personal | 10 000 | per key |
| Organization | 100 000 | per key |
Limits apply to the key exchange, not to your backend. Cache the JWT for its lifetime and refresh at
exp - 60s; a well-behaved service exchanges a key about a hundred times a day.
Revocation
Deleting a key stops new exchanges immediately. JWTs already issued remain valid until they expire (at most 15 minutes).