Authentication

Every API request is authenticated with an API key passed in an HTTP header.

Getting an API key

API keys are issued by the Digital Metal team. To request access, email connor@digitalmetal.io with a brief description of your integration.

What to include in your request

Your company name and the product you're building
How you intend to use the quoting API
Expected request volume

Once issued, your key will look like: dm_live_a3f8c2d1e4b7... — copy it somewhere safe immediately. If you lose it, contact us to have it revoked and replaced.

Using your key

Pass your API key in the X-API-Key header on every request.

GET /api/v1/materials HTTP/1.1
Host: digitalmetal.io
X-API-Key: dm_live_<your_key>

All API keys begin with the prefix dm_live_.

Key security

Treat keys like passwords

Store keys in environment variables or a secrets manager. Never commit them to source control or expose them in client-side code.

One key per integration

Request a separate key for each application or environment (development, staging, production). This way a single key can be revoked without disrupting your other integrations.

Report compromised keys immediately

If a key is exposed, email connor@digitalmetal.io and we will revoke it and issue a replacement. Revocation takes effect immediately.

Error responses

Authentication failures return a JSON body with an error field.

Status	Error	Cause
401	Missing X-API-Key header.	No header was sent.
401	Invalid API key format.	Key does not start with `dm_live_`.
401	Invalid API key.	Key not found in the database.
401	API key has been revoked.	Key was revoked by the owner.