API Key authentication is the simplest method. Use it for server-to-server integrations where a long-lived credential is appropriate.

Including the Key in a Request #

Primary method — Authorization header (recommended):

curl https://yoursite.com/wp-json/dmsi-api/v1/licenses \
  -H "Authorization: Bearer dmsi_key_<your-40-hex-chars>"

Alternative method — X-API-Key header:

curl https://yoursite.com/wp-json/dmsi-api/v1/licenses \
  -H "X-API-Key: dmsi_key_<your-40-hex-chars>"

Both headers are accepted. The Authorization: Bearer form is preferred for consistency with other token types.

What the Middleware Validates #

When an API key is presented, the middleware:

1. Extracts the 12-character prefix from the submitted key
2. Queries the dmsi_aapi_keys table for rows matching that prefix
3. Bcrypt-verifies the submitted key against the stored hash (cost 12)
4. Checks the key status is active (not revoked or deleted)
5. Checks the key has not expired (if an expiry datetime is set)
6. Enforces IP whitelist if configured (see Part 2 – API Keys, Doc 4: IP Whitelisting)

Permissions and Rate Limiting #

• The authenticated request inherits the scopes assigned to the key.
• The rate limit tier assigned to the key (or its override) applies to all requests made with that key.

Error Responses #