Skip to content

Authentication

Every DMS REST request authenticates with a per-user API key sent as a Bearer token.

Getting an API key

API keys are managed per WordPress user, on that user's profile screen:

  1. Sign in to WordPress admin and open Users → Profile (or edit another user, if you have permission).
  2. Under DMS API Keys, type a label (e.g. Mobile App, Zapier) and click Generate Key.
  3. Copy the Site URL and the API Key. For the mobile app, scan the key's QR code instead (it encodes site_url|key).

Each user can hold multiple labeled keys. Regenerating a key replaces its value immediately (old value stops working); deleting a key revokes it. The key-management UI appears only on installs entitled to the API.

The QR code and the raw key are the same secret in two forms - the app scans the QR; custom integrations copy the key string.

Making authenticated requests

Send the key as a Bearer token in the Authorization header:

curl https://your-site.com/wp-json/dms/v1/authenticate \
  -H "Authorization: Bearer 0a1b2c3d4e5f60718293a4b5c6d7e8"

The key resolves to its owning WordPress user, and that user's DMS capabilities determine what the request may do (see Capabilities).

Auth errors

Status code Meaning
401 dms_no_api_key No Bearer token in the Authorization header.
401 dms_invalid_api_key Token doesn't match any user's key.
403 dms_not_licensed Install isn't licensed for the API.
403 dms_forbidden Key is valid but the user lacks the capability the route requires.

GET /authenticate

Validates the key and returns the resolved identity, license tier, and the write capabilities the caller can rely on. Reaching a successful response means the key is valid.

Capability: none (any valid key).

{
  "success": true,
  "message": "Key is valid",
  "data": {
    "authenticated": true,
    "user_id": 12,
    "display_name": "Jane Dealer",
    "email": "jane@example.com",
    "account_type": "admin",
    "license_type": 3,
    "capabilities": {
      "add_inventory": true,
      "edit_all_inventory": true,
      "delete_inventory": true,
      "modify_gallery": true
    }
  }
}

See also