Authentication

Every request must send your academy API key as a Bearer token: Authorization: Bearer dwr_live_xxxxxxxxxxxx

How keys work

• Keys are created in Settings → Developers → API Keys in your dashboard.
• The key is shown once at creation — store it securely.
• Each key belongs to exactly one academy. The academy_id and granted scopes are derived server-side from the key — you can never pass an academy_id to act on another academy.
• Keys are managed only from the dashboard (create, rotate, revoke). There is no key-management endpoint, so a key can never mint or revoke another key.

Missing or invalid key

Returns HTTP 401 with { "error": { "code": "unauthorized" } }.

Test keys

Test keys help you label and organize integrations, but they do not run in an isolated sandbox — every key acts on your own academy data, and writes affect your account directly. Responses to a test key include the header X-Dwrrah-Environment-Warning: test_keys_act_on_live_account, so you can spot test traffic in your logs.