Authentication

Every request to the DocMind API is authenticated with a secret API key sent as a bearer token.

API keys

Create and manage keys under API Keys in the dashboard. Each key belongs to a single organization and inherits its isolation — a key can only ever read or write that organization’s data.

The Authorization header

Pass the secret as a bearer token on every request:

Authorization: Bearer sk_live_cwgqu6ofdtors4e36dnf25htigo36k5...

Requests with a missing, revoked, or malformed key are rejected:

HTTP/1.1 401 Unauthorized

{
  "error": {
    "code": "unauthorized",
    "message": "missing or invalid credentials"
  }
}

Scopes & environments

Verify organization

Returns the organization and auth scope for the current key. Agents and internal tools should call this once at startup to confirm they are connected to the expected workspace.

GET /v1/me

{
  "organization": {
    "id": "9c6c...",
    "name": "Acme Finance",
    "balance_cents": 2500
  },
  "auth": {
    "method": "api_key",
    "scope": "extract_only",
    "key_id": "3b21..."
  }
}

Keeping keys safe

• Secrets are shown once at creation — store them in a secret manager, never in source control.
• Use server-side calls only; never expose a key in browser or mobile client code.
• Scope keys to extract_only when a service doesn’t need to manage settings.
• Rotate by creating a new key and revoking the old one — revocation takes effect immediately.