Authentication
All Partner API endpoints require a Partner API Key — a long-lived secret scoped to your logistics company.
How it works
Every request must include the key in the X-Partner-API-Key HTTP header:
GET /partner/api-keys HTTP/1.1
Host: api.digiantlabs.com
X-Partner-API-Key: dpk_live_abc123...
DigiAnt validates the key and resolves your logistics_company_id from it automatically — no need to include it in the URL or the request body.
Managing API keys
API keys are managed directly through the Partner API under /partner/api-keys. The initial key creation (bootstrap) requires backoffice JWT authentication; all other operations use the X-Partner-API-Key header.
| Action | Endpoint | Auth |
|---|---|---|
| Create the first key | POST /partner/api-keys | JWT (backoffice) |
| List active keys | GET /partner/api-keys | X-Partner-API-Key |
| Revoke a key | DELETE /partner/api-keys/{id} | X-Partner-API-Key |
| Rotate keys | POST /partner/api-keys/{id}/rotate | X-Partner-API-Key |
The plaintext key is shown exactly once when you generate it. Store it immediately in your secrets manager. DigiAnt only stores a SHA-256 hash and cannot recover the plaintext later.
Key format
Keys are prefixed dpk_ for easy identification in logs and secrets managers. Example (shortened):
dpk_live_TFpq3vMNnWnuEkSR7bLsdEoGkJhH...
Rotating a key
Rotation is a zero-downtime operation:
- Call
POST /partner/api-keys/{id}/rotate - DigiAnt deactivates all existing keys for your company and issues a new one
- Update your secrets manager with the new plaintext key before making the next API call
Rotate keys on a schedule (e.g., every 90 days) or after any suspected exposure. Keep the rotation window short: the old key stops working as soon as rotation is triggered.
Security recommendations
| Recommendation | Why |
|---|---|
| Store the key in a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.) | Never commit keys to source control |
| Use HTTPS for all requests | Keys sent over plain HTTP are exposed in transit |
| Rotate after any exposure | Revoke and re-generate immediately if a key leaks |
| Use a per-environment key | Keep staging and production keys separate |
| Name keys descriptively | "Production ERP — GOF" is easier to audit than "key 1" |
Error responses
| HTTP status | Error name | Meaning |
|---|---|---|
401 Unauthorized | partner_api_key.not_found | Key missing, invalid, or revoked |
401 Unauthorized | partner_api_key.expired | Key exists but expires_at has passed |