> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/daytonaio/daytona/llms.txt
> Use this file to discover all available pages before exploring further.
# Authentication
> Authenticate your API requests using API keys or OAuth 2.0
# API Authentication
Daytona API supports two authentication methods: **API Key authentication** (recommended for most use cases) and **OAuth 2.0 / OpenID Connect** (for user-facing applications).
## API Key Authentication
API keys provide the simplest way to authenticate programmatic access to the Daytona API.
### Creating an API Key
Create an API key using the Daytona dashboard or CLI:
```bash theme={null}
daytona api-key create "My API Key" \
--permissions write:sandboxes,read:snapshots \
--expires-at 2025-12-31T23:59:59Z
```
Or via the API:
```bash theme={null}
curl -X POST https://api.daytona.io/api-keys \
-H "Authorization: Bearer YOUR_EXISTING_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "My API Key",
"permissions": ["write:sandboxes", "read:snapshots"],
"expiresAt": "2025-12-31T23:59:59Z"
}'
```
### Using API Keys
Include your API key in the `Authorization` header using the Bearer scheme:
```bash theme={null}
curl -X GET https://api.daytona.io/sandbox \
-H "Authorization: Bearer YOUR_API_KEY"
```
**Keep your API keys secure**. Never commit API keys to version control or expose them in client-side code.
### API Key Headers
Bearer token containing your API key
Format: `Bearer YOUR_API_KEY`
Organization ID for multi-org API keys. Required when your API key has access to multiple organizations.
### Example: Creating a Sandbox
```python theme={null}
import requests
url = "https://api.daytona.io/sandbox"
headers = {
"Authorization": "Bearer dta_1234567890abcdef",
"Content-Type": "application/json"
}
payload = {
"alias": "python-sandbox",
"snapshot": "python:3.11"
}
response = requests.post(url, json=payload, headers=headers)
print(response.json())
```
### API Key Permissions
API keys support granular permissions for organization resources:
* `read:sandboxes` - List and view sandboxes
* `write:sandboxes` - Create, update, and delete sandboxes
* `read:snapshots` - List and view snapshots
* `write:snapshots` - Create and delete snapshots
* `read:volumes` - List and view volumes
* `write:volumes` - Create and delete volumes
* `read:registries` - View registry configurations
* `write:registries` - Manage registry configurations
* `admin:organization` - Full organization administration
### Managing API Keys
#### List API Keys
```bash theme={null}
curl -X GET https://api.daytona.io/api-keys \
-H "Authorization: Bearer YOUR_TOKEN"
```
#### Get Current API Key Details
```bash theme={null}
curl -X GET https://api.daytona.io/api-keys/current \
-H "Authorization: Bearer YOUR_API_KEY"
```
#### Delete API Key
```bash theme={null}
curl -X DELETE https://api.daytona.io/api-keys/my-key-name \
-H "Authorization: Bearer YOUR_TOKEN"
```
### API Key Expiration
API keys can have optional expiration dates. When an API key expires:
* All requests using the key will receive a `401 Unauthorized` response
* The key is automatically marked as inactive
* You must create a new API key to restore access
**Best practices:**
* Set expiration dates for temporary access
* Rotate API keys regularly for production use
* Use shorter expiration periods for development/testing
## OAuth 2.0 / OpenID Connect
Use OAuth 2.0 for user-facing applications that need to act on behalf of authenticated users.
### OpenID Connect Configuration
Daytona's OpenID Connect endpoint is available at:
```
GET /.well-known/openid-configuration
```
Response includes:
```json theme={null}
{
"issuer": "https://api.daytona.io",
"authorization_endpoint": "https://api.daytona.io/oauth/authorize",
"token_endpoint": "https://api.daytona.io/oauth/token",
"userinfo_endpoint": "https://api.daytona.io/oauth/userinfo",
"jwks_uri": "https://api.daytona.io/.well-known/jwks.json"
}
```
### OAuth Scopes
Daytona supports the following OAuth scopes:
* `openid` - Required for OpenID Connect
* `profile` - Access to user profile information
* `email` - Access to user email address
### Using JWT Tokens
After completing the OAuth flow, use the JWT token in the Authorization header:
```bash theme={null}
curl -X GET https://api.daytona.io/users/me \
-H "Authorization: Bearer YOUR_JWT_TOKEN"
```
### Multi-Organization Access
When a JWT token has access to multiple organizations, specify which organization to use:
```bash theme={null}
curl -X GET https://api.daytona.io/sandbox \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "X-Daytona-Organization-ID: org_abc123"
```
## Authentication Errors
### 401 Unauthorized
Your API key is invalid, expired, or missing.
```json theme={null}
{
"statusCode": 401,
"message": "Unauthorized",
"error": "Invalid or expired API key"
}
```
**Solutions:**
* Verify your API key is correct
* Check if the API key has expired
* Ensure the Authorization header is properly formatted
### 403 Forbidden
Your API key lacks required permissions.
```json theme={null}
{
"statusCode": 403,
"message": "Forbidden",
"error": "Insufficient permissions"
}
```
**Solutions:**
* Review required permissions for the endpoint
* Create a new API key with appropriate permissions
* Contact your organization administrator
## Security Best Practices
* Store API keys in environment variables or secret management systems
* Never hardcode API keys in source code
* Use different API keys for development and production
* Rotate API keys regularly
* Grant minimum required permissions
* Create separate API keys for different applications
* Set expiration dates appropriate for use case
* Monitor API key usage and audit logs
* Always use HTTPS for API requests
* Avoid logging API keys in application logs
* Don't send API keys as query parameters
* Revoke compromised keys immediately
## Next Steps
Understand API rate limiting
Make your first API request
Handle authentication errors
Use official SDK libraries