Skip to main content

​
Overview

Every request to /v1/* must include an Authorization header with a valid API token: 
Authorization: Bearer <your_token>
Requests without a valid token return TOKEN_INVALID (401).

​
Creating a token

  1. Open the dashboard
  2. Click New token
  3. Copy the token immediately — it is shown only once and cannot be retrieved again
If you lose a token, revoke it from the dashboard and generate a new one.

​
Using your token

Pass the token in the Authorization header on every request: 
curl https://api.done.app/v1/schemas \
  -H "Authorization: Bearer <your_token>"
Never include your API token in client-side code or commit it to source control. Store it in an environment variable or a secrets manager.

​
Example — environment variable

# .env
DONE_API_KEY=your_token_here

const res = await fetch('https://api.done.app/v1/schemas', {
  headers: {
    Authorization: `Bearer ${process.env.DONE_API_KEY}`,
    'Content-Type': 'application/json',
  },
})

​
Token security model

PropertyDetail
StorageOnly the SHA-256 hash of your token is stored. The plaintext is never persisted.
RetrievalTokens cannot be retrieved after creation. Lost tokens must be revoked and replaced.
ScopeTokens are scoped to your account — they can access all resources owned by your user.
RotationRevoke a token from the dashboard at any time. Revocation is immediate.

​
Error responses

SituationCodeStatus
Authorization header missingTOKEN_INVALID401
Wrong scheme (not Bearer)TOKEN_INVALID401
Token not found or revokedTOKEN_INVALID401
See TOKEN_INVALID for the full error reference.