Authentication for API v2021-12-15#

DIDWW API v3 uses API-key authentication.

Send your API key in the Api-Key request header with every protected API request:

Api-Key: YOUR_API_KEY

Requests without a valid API key are rejected. Send only the key as the header value, do not add a Bearer prefix.

API keys#

API keys are created and managed in the DIDWW User Panel. For creation instructions, see How to Get Your API Key.

When creating an API key, you can configure:

Setting	Description
Friendly name	A recognizable name for the API key.
Allowed IP addresses	Optional source-IP restrictions for requests using the key.
Enable callbacks	Allows supported real-time API event notifications.

Environments#

Environment	API base URL	Manage API keys
Sandbox	`https://sandbox-api.didww.com/v3`	Sandbox User Panel
Production	`https://api.didww.com/v3`	Production User Panel

Production and Sandbox use separate accounts and API keys. Always use the key created in the same environment as the API request; the credentials are not interchangeable.

Example#

curl https://api.didww.com/v3/countries \
  --header "Api-Key: YOUR_API_KEY" \
  --header "Accept: application/vnd.api+json"

Rate limits#

Each API key is limited to 20 requests per second. If the limit is exceeded, the API returns HTTP 429 Too Many Requests.

Wait before retrying a rate-limited request and avoid immediate repeated retries.

Security recommendations#

Keep API keys secure and use them only from trusted server-side environments.

Recommended practices:

Store API keys in environment variables or a secure secrets manager.
Do not expose API keys in client-side code, public repositories, browser applications, or mobile apps.
Use allowed IP address restrictions where possible.
Use separate API keys for different applications or environments.
Replace API keys if they may have been exposed.
Remove API keys that are no longer used.

Authentication errors#

Status code	Meaning
`401 Unauthorized`	The API key is missing, invalid, inactive, belongs to another environment, or is blocked by its source-IP restrictions.
`403 Forbidden`	Authentication succeeded, but the account is not allowed to perform the requested operation.
`429 Too Many Requests`	The API key exceeded its request rate limit.