Guide

Authentication

Digitizer uses a secret API key scoped to one business. Send the key on every request, including uploads. Requests without a valid key are rejected with HTTP 401.

Workspace owners create keys in Dashboard → API credentials after selecting a business. The secret is shown once. Keep it server-side and use HTTPS when connecting to the service. Examples use placeholder credentials; replace them with your own key.

The X-API-Key header

This is the preferred form. It keeps the key out of URLs, logs, and browser history.

Header

curl --request GET \
  --url 'https://digitizer.ee/api/v1/documents' \
  --header 'X-API-Key: dig_live_xxxxxxxxxxxx'

Bearer tokens

Digitizer accepts Authorization: Bearer <key> as a drop-in equivalent.

Bearer

curl --request GET \
  --url 'https://digitizer.ee/api/v1/documents' \
  --header 'Authorization: Bearer dig_live_xxxxxxxxxxxx'

When authentication fails

A missing key yields missing_api_key. An unrecognized key yields invalid_api_key.

401 Unauthorized

{
  "success": false,
  "error": {
    "code": "invalid_api_key",
    "message": "The provided API key is not valid."
  }
}

Keys are secrets. Never ship them in client-side JavaScript, mobile bundles, or public repositories. If a key leaks, rotate it and revoke the old value — revocation takes effect immediately.