Skip to main content

Authentication

Most 3PL fulfillment endpoints accept either:

  • a standard DYLI Public API key; or
  • a 3PL API key issued by DYLI for your company.

Keys created at dyli.io/requestapi are standard Public API keys and work with the 3PL endpoints. You do not need a separate 3PL-specific key unless DYLI provides one for your integration.

Send either key through the x-api-key header:

export DYLI_3PL_COMPANY="your-company-slug"
export DYLI_3PL_API_KEY="your_key"

curl "https://www.dyli.io/api/3pl/$DYLI_3PL_COMPANY/username?username=alex" \
  -H "x-api-key: $DYLI_3PL_API_KEY"

Standard Public API keys can also be sent in the Authorization header:

curl "https://www.dyli.io/api/3pl/$DYLI_3PL_COMPANY/username?username=alex" \
  -H "Authorization: Bearer $DYLI_API_KEY"

Use the header form in production. Query-string keys can leak through browser history, analytics, and server logs.

Key Handling​

  • Store keys in a server-side environment variable or secret manager.
  • Never include a key in client-side JavaScript or a public repository.
  • Use a separate key for each integration when possible.
  • Rotate a key immediately if it is exposed.

Standard Public API keys use the Public API rate limit and return X-RateLimit-* headers. Your 3PL API key may have a separate limit set by DYLI.

Inventory Access​

GET /api/3pl/{company}/inventory has an additional account-level check because it returns private warehouse stock. It requires a standard DYLI Public API key whose owning DYLI account can already open that company's 3PL section in the Inventory Dashboard. A key belonging to another account or another 3PL company receives 403.

Company-specific partner keys used for rates, orders, status, and address requests do not bypass this check. Create the standard key while signed in to an authorized account, keep it on your server, and use that key for inventory reads.

Create or manage your keys at dyli.io/requestapi, or contact DYLI support.