API Authentication — Keys & JWT

Every request to the Data Mammoth API must be authenticated. This guide covers how to generate API credentials, authenticate requests using API keys and JWT tokens, and follow security best practices.

Authentication Methods

Data Mammoth supports two authentication methods:

API Key Authentication

Generating an API Key

Using API Keys in Requests

Include your API key in the Authorization header as a Bearer token:

curl -X GET "https://api.datamammoth.com/v1/servers" \
  -H "Authorization: Bearer dm_key_abc123def456" \
  -H "Content-Type: application/json"

API Key Format

API keys follow the format: dm_key_ followed by a random alphanumeric string. Keep this key confidential.

JWT Authentication

JWT (JSON Web Token) authentication provides time-limited tokens for enhanced security.

Obtaining a JWT Token

Exchange your API credentials for a JWT token:

curl -X POST "https://api.datamammoth.com/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "dm_key_abc123def456",
    "api_secret": "your_api_secret"
  }'

Response:

{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "expires_at": "2026-03-17T12:00:00Z",
  "token_type": "Bearer"
}

Using JWT Tokens in Requests

curl -X GET "https://api.datamammoth.com/v1/servers" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json"

Token Expiration and Refresh

JWT tokens expire after a set period. When a token expires:

Implement token refresh logic in your application to handle expiration automatically.

Managing API Keys

Viewing Active Keys

Navigate to Account Settings > API to see all your API keys, including:

• Key label
• Creation date
• Last used date
• Status (active/revoked)

Revoking a Key

If a key is compromised or no longer needed:

The key is immediately invalidated. Update any applications using the revoked key.

Key Rotation

Regularly rotate your API keys for security:

Security Best Practices

Protect Your Credentials

export DM_API_KEY="dm_key_abc123def456"

import os
api_key = os.environ.get('DM_API_KEY')

Limit Key Scope

• Use separate keys for different environments (development, staging, production).
• Use separate keys for different applications or team members.
• Revoke keys for applications or team members that no longer need access.

Monitor Usage

• Review API key activity regularly.
• Investigate any unexpected usage patterns.
• Set up alerts for unusual API activity if available.

Use HTTPS

All API communication must use HTTPS. The API does not accept unencrypted HTTP requests.

Troubleshooting Authentication

401 Unauthorized

• Verify the API key is correct and has not been revoked.
• Check that the Authorization header format is correct: Bearer YOUR_KEY.
• If using JWT, check if the token has expired.

403 Forbidden

• The API key may not have permission for the requested action.
• Check if the key has the required scope or permissions.

Invalid Token Format

• Ensure there are no extra spaces or characters in the token.
• Copy the token directly from the dashboard — do not retype it.

What to Do Next

• API Quickstart — Your First API Call — Make your first authenticated request.
• API Overview — Understand the API architecture.
• API Rate Limits & Best Practices — Optimize your usage.
• API Error Codes & Handling — Handle errors gracefully.