Authentication

API keys and security for accessing your data.

API Keys#

Each project has a unique API key that starts with dc_. Find yours in the project settings page.

Keep Your API Key Secret

Never expose your API key in client-side code. Anyone with your key can access your data.

Authentication Methods#

Header Authentication (Recommended)

Pass your API key in the X-API-Key header:

Using Header

curl -X GET "https://dataclean.to/v1/your-project/items" \
  -H "X-API-Key: dc_your_api_key_here"

Query Parameter

Alternatively, pass the key as a query parameter (useful for simple testing):

Using Query Param

curl "https://dataclean.to/v1/your-project/items?api_key=dc_your_api_key_here"

Warning

Query parameter authentication exposes your key in server logs and browser history. Use header authentication in production.

Code Examples#

JavaScript (fetch)

fetch.js

const response = await fetch('https://dataclean.to/v1/my-project/items', {
  headers: {
    'X-API-Key': process.env.DATACLEAN_API_KEY
  }
});
const { data } = await response.json();

Python (requests)

fetch.py

import requests
import os

response = requests.get(
    'https://dataclean.to/v1/my-project/items',
    headers={'X-API-Key': os.environ['DATACLEAN_API_KEY']}
)
data = response.json()['data']

Security Best Practices#

Use Environment Variables

Store API keys in environment variables, not in code

Server-Side Requests Only

Make API calls from your server, never from the browser

Rotate Keys Regularly

Generate new API keys periodically from project settings

Error Responses#

Code	Error	Solution
`401`	Missing or invalid API key	Check your API key is correct and included
`403`	Access denied	API key doesn't have access to this project
`429`	Rate limited	Too many requests. Wait and retry with backoff.

Field Mapping API Endpoints