Authentication

Every request requires an API key in the HTTP Authorization header:

Authorization: Bearer $DAILY_API_KEY

The scheme and Bearer prefix are case-sensitive. Do not add spaces inside the key.

Business-scoped keys

A key is permanently associated with one Daily business. Daily derives business scope from the authenticated key; the client cannot select or override a business ID. A valid resource ID belonging to another business returns the same resource_not_found response as a missing resource.

Environments

Daily keys include an environment marker. Production accepts live keys and non-production environments accept test keys. A key for the wrong environment is rejected before credential lookup with invalid_api_key.

One-time visibility and storage

The complete key is shown once after creation or rotation. Daily stores a SHA-256 hash used for constant-time comparison, plus a non-secret public identifier and last four characters for management. The full secret cannot be recovered later.

Your integration should store the key in an encrypted secret manager or an equivalently protected environment-injection system. Never embed it in frontend or mobile code: users, browser extensions, source maps, and device backups can extract shipped secrets.

Expiration and subscription access

Keys are created with a configured expiration. After that timestamp the API returns 401 expired_api_key. Public API access also requires an active eligible Daily subscription and an active business. If access becomes unavailable, valid keys remain stored but requests return 403 api_access_inactive until access is restored.

Rotation

Rotation creates a new secret for the same key identity. The old secret remains valid for 24 hours.

1. Rotate in Daily → API keys.
2. Save the new secret in your secret manager.
3. Deploy and verify the new secret.
4. Remove the old secret from every environment before the grace period ends.

Never rely on the grace period as a permanent fallback.

Revocation

Revocation is immediate and irreversible. Requests using a revoked key return 401 revoked_api_key. Revoke keys when an integration is retired, ownership changes, or exposure is suspected.

IP and CIDR restrictions

An optional allowlist can contain up to 20 IPv4, IPv6, or CIDR entries. When configured, requests are accepted only when the client address observed by Daily matches an entry. A mismatch returns 403 ip_not_allowed. Keep outbound NAT changes synchronized with the allowlist.

Browser use

Production integrations must call Daily from a trusted server. The documentation playground is for controlled testing only: the entered key stays in current-page React memory, is cleared on refresh, and is sent directly from https://docs.godaily.co.il to the public API.