> For the complete documentation index, see [llms.txt](https://help.dollarlabs.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.dollarlabs.io/dollarlabs-b2b-custom-pricing/developer-tools/api-keys.md).

# API keys

Every API request authenticates with a **key** and a **signing secret**. Manage them under **API Keys** in the app.

## Creating a key

1. Open **API Keys**.
2. Choose to generate a new key.
3. Give it a **name** describing what will use it — `ERP nightly sync`, `PIM staging`. You will thank yourself when there are five.
4. Optionally add **allowed IPs**, comma-separated.
5. Generate.

You get two values:

| Value          | Prefix | Header             |
| -------------- | ------ | ------------------ |
| API key        | `dlb_` | `X-API-Key`        |
| Signing secret | `sec_` | `X-Signing-Secret` |

Both are required on every request.

{% hint style="danger" %}
**Credentials are shown once, at creation.** Copy them into your secret store immediately. If you lose them, revoke the key and create another — they cannot be retrieved.
{% endhint %}

## Restricting by IP

**Allowed IPs** limits a key to requests originating from addresses you list. If your ERP has a static outbound IP, set it — a leaked key is then useless from anywhere else.

Leave it empty to accept requests from any address.

{% hint style="warning" %}
Only set this if your outbound IP is genuinely static. Cloud workers, serverless functions and most CI runners rotate addresses, and requests will start failing without an obvious cause.
{% endhint %}

## Revoking

Revoke a key to stop it working immediately. Revoked keys disappear from the active list; you can still view them separately for audit.

Revoke when:

* a credential may have leaked
* someone with access to it leaves
* an integration is retired

Revocation takes effect at once, so make sure nothing in production is still using the key.

## Good practice

* **One key per integration.** Retiring one system then never disturbs another.
* **Never commit credentials.** Environment variables or a secret manager.
* **Separate staging from production.** Different keys, clearly named.
* **Rotate on a schedule.** Create the replacement, deploy it, then revoke the old one — in that order, so there is no gap.

## Using them

```bash
curl https://pricelist-app.dollarlabs.io/api/v1/pricing \
  -H "X-API-Key: dlb_your_key_here" \
  -H "X-Signing-Secret: sec_your_secret_here"
```

Full reference: [Pricing API](/dollarlabs-b2b-custom-pricing/developer-tools/api-for-bulk-update-pricing.md).

## Common problems

**401 or 403.**\
A wrong or revoked credential, or only one of the two headers is being sent. Both are required.

**Works locally, fails in production.**\
Almost always an IP allowlist that does not include your production egress address.