Skip to main content
Every request is authenticated with an API key sent in the Authorization header. 
Authorization: dk_live_your_api_key_here
Content-Type: application/json

​
API keys

API keys are issued by the doola team, one per environment.
PrefixEnvironment
dk_test_Sandbox (https://api.test.doola.com)
dk_live_Production (https://api.doola.com)
Treat API keys as secrets. Use them only from your backend, never in client side code. A sandbox key does not work against production, and the reverse is also true.
Manage your keys, webhook endpoint, and event subscriptions in the doola Partner Portal, including rotating a key. Don’t have access yet? Get API access.

​
Request headers

HeaderRequiredDescription
AuthorizationYesYour API key, sent as the raw value (no Bearer prefix).
Content-TypeOn writesapplication/json for POST requests.
Idempotency-KeyOn writesRequired on create endpoints. Makes retries safe.
x-request-idNoOptional correlation id. Echoed back on the response.

​
Idempotency

The create endpoints (POST /v1/partner/customers and POST /v1/partner/companies) require an Idempotency-Key.
  • Use a unique value per logical operation, for example a UUID tied to your own record.
  • Retrying with the same key and the same body returns the original result and never creates a duplicate.
  • Reusing a key with a different body returns 409 E_IDEMPOTENCY_KEY_REUSED.
  • After a 4xx, use a fresh key for the corrected request.