# Authentication for API v2026-04-16

DIDWW API v3 uses API-key authentication.

Send your API key in the `Api-Key` request header with every protected API
request:

```
Api-Key: YOUR_API_KEY
```

Requests without a valid API key are rejected. Send only the key as the
header value, do not add a `Bearer` prefix.

## API keys

API keys are created and managed in the DIDWW User Panel. For creation
instructions, see [How to Get Your API Key](../configuration.html#api-key).

When creating an API key, you can configure:

| Setting | Description |
| --- | --- |
| Friendly name | A recognizable name for the API key. |
| Allowed IP addresses | Optional source-IP restrictions for requests using the key. |

## Environments

| Environment | API base URL | Manage API keys |
| --- | --- | --- |
| Sandbox | `https://sandbox-api.didww.com/v3` | [Sandbox User Panel](https://my-sandbox.didww.com/#/api) |
| Production | `https://api.didww.com/v3` | [Production User Panel](https://my.didww.com/#/api) |

Production and Sandbox use separate accounts and API keys. Always use the key
created in the same environment as the API request; the credentials are not
interchangeable.

## Example

```
curl https://api.didww.com/v3/countries \
  --header "Api-Key: YOUR_API_KEY" \
  --header "Accept: application/vnd.api+json"
```

## Rate limits

Each API key is limited to 20 requests per second. If the limit is exceeded,
the API returns HTTP `429 Too Many Requests`.

Wait before retrying a rate-limited request and avoid immediate repeated
retries.

## Security recommendations

Keep API keys secure and use them only from trusted server-side environments.

Recommended practices:

- Store API keys in environment variables or a secure secrets manager.
- Do not expose API keys in client-side code, public repositories, browser
  applications, or mobile apps.
- Use allowed IP address restrictions where possible.
- Use separate API keys for different applications or environments.
- Replace API keys if they may have been exposed.
- Remove API keys that are no longer used.

## Authentication errors

| Status code | Meaning |
| --- | --- |
| `401 Unauthorized` | The API key is missing, invalid, inactive, belongs to another environment, or is blocked by its source-IP restrictions. |
| `403 Forbidden` | Authentication succeeded, but the account is not allowed to perform the requested operation. |
| `429 Too Many Requests` | The API key exceeded its request rate limit. |

## Related pages

- [OpenAPI Reference](api-reference.html)
- [Getting Started](../configuration.html)
- [API Specification](../specification/index.html)
- [API Requests in Postman](../postman.html)
- [DIDWW API Sandbox](../sandbox.html)

On this page