API Authentication

The public REST API uses API key authentication for server-to-server and B2B integrations.

Creating an API key

Administrators can generate API keys in Settings > API Keys:

1. Click Generate Key.
2. Give the key a descriptive name (e.g., "Business Central Sync").
3. Copy the key immediately -- it is only displayed once.

Using an API key

Include the key in the X-API-KEY header:

curl https://app.dimesheets.com/api/v1/time-entries \
  -H "X-API-KEY: your-api-key-here"

The public integration surface is under /api/v1/.... API keys inherit the permissions of the Administrator role and are scoped to the tenant that created them. Treat API keys as secrets and store them securely.

Revoking a key

In Settings > API Keys, click the revoke button next to any key. Revocation is immediate and any requests using that key will be rejected.

Error responses

Authentication failures return 401 Unauthorized:

{
  "status": 401,
  "title": "Unauthorized",
  "detail": "Invalid or expired API key."
}

Requests with valid credentials but insufficient permissions return 403 Forbidden:

{
  "status": 403,
  "title": "Forbidden",
  "detail": "You do not have permission to access this resource."
}