Skip to main content
Every request carries an agency API key. It authenticates the acting agency and scopes every request to that agency’s own sub-accounts; an agency can only ever see and act on its own workspaces. An agency key starts dmly_ag_, which is what distinguishes it from a workspace key (dmly_…). The two are not interchangeable: an agency key is rejected by the workspace API, and a workspace key is rejected here.

​
Sending the key

Send it as the x-api-key header:
A bearer token is also accepted:
Both are equivalent. If both are present, x-api-key wins.

​
Creating a key

1

Open the agency console

In the agency console, go to Configuration → API.
2

Generate a key

Select + Generate key. Give it a name describing what will use it, so you can recognise it later when rotating or revoking, then select Generate.
3

Copy it now

The key is shown once, under Copy your API key now. DMLY stores only a hash of it, so it cannot be retrieved or emailed to you afterwards.
An agency key can provision workspaces and change subscriptions across every one of your sub-accounts. Treat it like a password: keep it server-side, never commit it, and never ship it in client-side code.

​
Rotating and revoking

Create the replacement key first, deploy it, then revoke the old one. Revocation takes effect immediately, and any caller still using the old key starts getting 401. DMLY stamps a last-used time on every authenticated request, so you can tell whether a key is still in use before retiring it.

​
When authentication fails

A 503 is not about your key; it means DMLY has temporarily disabled the reseller API for everyone, typically during an incident. Retry later; your key still works once it is back on.

​
Rate limit

The reseller API allows 120 requests per minute per agency key. That is a separate, larger budget than the workspace REST API’s 60 per minute, because one agency key manages many sub-accounts. Requests whose key doesn’t resolve (missing, mistyped or revoked) fall back to a shared 60 requests per minute per IP address instead. They still fail with 401; the shared bucket only caps how fast you can retry. On a 429, wait the number of seconds in Retry-After (the message states the same figure) and retry.