Authentication

All requests to the Dome Tech Enterprise API require an API key.

API Key

Send your API key in the X-API-Key header with every request:

curl -H "X-API-Key: dome_live_your_key_here" \
  https://api.dometech.com.au/v1/jobs

Test vs Live Keys

Dome Tech uses a Stripe-style test/live key model. Both key types hit the same API — the key prefix determines the mode.

Feature	Test Key `dome_test_*`	Live Key `dome_live_*`
Billing	Free (no charges)	Real billing at configured rates
Rate Limit	Fixed 10 req/min	Per-org configurable (default 60 req/min)
Usage Tracking	Tracked (visible in dashboard)	Tracked and billed
Job Isolation	Test key only sees test jobs	Live key only sees live jobs
Response Meta	`"mode": "test"`	`"mode": "live"`

Both key types use the same base URL and endpoints. Switch between test and live using the mode toggle in the developer dashboard.

Key Format

API keys use a mode-based prefix:

dome_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

dome_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

Security

Keep your API key secret. Do not expose it in client-side code.
All requests must be made over HTTPS.
Rotate your key immediately if you believe it has been compromised. You can do this from the API Keys page in your dashboard.

Rate Limits

Rate limits are applied per API key:

Key Type	Requests/min	Configurable
Test (`dome_test_*`)	10	No (fixed)
Live (`dome_live_*`)	60 (default)	Yes (per-org)

When you exceed the rate limit, the API returns a 429 Too Many Requests response. Check the X-RateLimit-Remaining header to monitor your usage.

Error Responses

Authentication failures return a 401 status code:

{
  "error":  {
    "code":  "UNAUTHORIZED",
    "message":  "Invalid or missing API key"
  },
  "meta":  {
    "request_id":  "req_abc123",
    "timestamp":  "2026-02-09T10:00:00.000Z"
  }
}