Authentication

DYLI API endpoints require an API key. Create and manage self-serve keys at dyli.io/requestapi.

Use the x-api-key header:

curl "https://www.dyli.io/api/public/v1/search?q=charizard" \
  -H "x-api-key: $DYLI_API_KEY"

Or use a bearer token:

curl "https://www.dyli.io/api/public/v1/search?q=charizard" \
  -H "Authorization: Bearer $DYLI_API_KEY"

Legacy Public Read endpoints accept apiKey or apikey as a query parameter for browser testing, but headers are strongly recommended because URLs can be stored in logs, analytics, and browser history.

curl "https://www.dyli.io/api/public/v1/fair-drops/31412/verify?apiKey=$DYLI_API_KEY"

The Commerce API requires x-api-key or Authorization: Bearer; it does not accept keys in URLs or request bodies.

Scopes

Scope	Access
read	Read API and white-label catalog reads
commerce	Commerce API catalog and mutation access
write	Admin-issued write access

Commerce mutations require a key with the commerce or write scope. A read key may read Commerce catalog/config resources but cannot create or update resources.

Storage

DYLI stores key prefixes and SHA-256 hashes, not raw keys. If a key is lost, revoke it and issue a new one.

Free keys are limited to 30 requests per minute. Use backoff after a 429 response.