Authentication

All API requests require a valid API key passed in the Authorization header.

API Keys

API keys start with dk_live_ and are created from the dashboard.

curl -X POST https://api.getdeckle.dev/v1/generate \
  -H "Authorization: Bearer dk_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1>Hello</h1>"}'

SDK Authentication

import { Deckle } from '@getdeckle/sdk';
const df = new Deckle(process.env.DECKLE_API_KEY);

from deckle import Deckle
df = Deckle("dk_live_...")

Security Best Practices

Never expose API keys in client-side code — always use server-side API calls or environment variables
Rotate keys regularly — create new keys and revoke old ones from the dashboard
Use separate keys for development and production
Keys are hashed — we never store your API key in plaintext

Rate Limits

Plan	Rate Limit
Free	10 requests/second
Starter	100 requests/second
Pro	100 requests/second
Enterprise	500 requests/second

When rate limited, the API returns 429 Too Many Requests with a Retry-After header.