DESelf-host

Service API keys and claims

Use service API keys for scripts and third-party systems instead of browser sessions. Each key is bound to a user and carries ABAC permissions.

Create a key

  • Set DOCUVATE_SERVICE_API_KEYS in .env as a JSON array with keyId, secret, tenantUserId, and claims.
  • Restart the API so keys are loaded.
  • Send the secret in Authorization: Bearer <secret> or X-Docuvate-Api-Key.

Claims (permissions)

Claims describe which actions the key may perform (for example read documents or manage labels). The exact shape matches the OpenAPI contract and SDK docs.

See the SDK guide for a full example and test against GET /v1/openapi.json on your instance.

Security

  • Treat secrets like passwords: do not commit them, plan rotation.
  • Use one key per integration with minimal claims.
  • Production URLs and TLS are your responsibility (reverse proxy, certificates).