Setting an Expiry Date #

When creating or editing an API key, you can set an optional expiry datetime. After this datetime:

• The key returns HTTP 401 with error code api_key_expired on any authentication attempt.
• The key remains in the database for audit purposes.

Expiry Warning Notifications #

The plugin runs a daily WP-Cron job that checks for API keys expiring within the next 7 days. For each key approaching expiry, an email notification is sent to the WordPress admin email address. The email includes the key name and expiry datetime so you can plan rotation in advance.

Expired Key Response #

HTTP 401 Unauthorized
{
  "code": "api_key_expired",
  "message": "The API key has expired.",
  "data": { "expired_at": "2026-04-01T00:00:00Z" }
}

Key Rotation Workflow #

Rotating an API key without downtime:

1. Create a new key at DDLS > Developer > API Keys > Add New with the same (or updated) scopes and settings. Copy the new key value immediately.
2. Update your integrations to use the new key value. Deploy the update to all services that use the old key.
3. Verify that requests are authenticating successfully with the new key.
4. Revoke the old key at DDLS > Developer > API Keys. The old key is immediately rejected. Its record is preserved for audit purposes.

Part of the DMSI Advanced API v1.0.1 documentation set.
Cross-reference: For authentication methods that use API keys, see Part 3 – Authentication. When publishing to BetterDocs, update this cross-reference to use the BetterDocs slug-based URL for the Authentication article (e.g., /docs/dmsi-advanced-api/authentication/).