Duplo DashboardGetting Started
Get your API key from Duplo Dashboard, authenticate your first request, and configure the credential.
Duplo Dashboard is Duplo's enterprise solution for managing business operations and spending. This page covers the setup every integration shares: getting a credential from the dashboard, authenticating with it, and configuring what it can do.
Everything here runs against one base URL:
https://dashboard.tryduplo.comPrerequisites
Your business must be ready in Duplo Dashboard before the API will accept a call:
- The business is active in Duplo Dashboard.
- Your business has Developer API enabled. If it is not, contact support to request access.
- You are the business owner or an admin. API key access is granted to those two roles only.
Getting your API credentials
API keys are not generated through this API. They are issued from Duplo Dashboard itself.
Log in, go to Settings › Developer API, and under API credentials click Generate API credentials. That issues two values:
- API key, prefixed
pk_live_orpk_test_. The credential that authenticates every request. - Client secret key, prefixed
sk_live_orsk_test_. Used only to encrypt request bodies, and only if you turn on field-level request encryption.
Both are shown once, at creation time, and never again, so store them securely before you leave the page.
One active key per mode
Generating new credentials immediately invalidates the previous key for that mode, so treat rotation as a coordinated deploy rather than a routine click. Rotation is scoped to the mode you are in: rotating your live key never touches an active test key, and vice versa. Only the key material changes, so your IP allowlist and encryption setting carry over to the new key.
The prefix carries the mode, so a pk_test_ key does not authenticate live traffic and a pk_live_ key does not reach test data.
Authenticating your requests
Every endpoint takes your API key as a bearer token:
Authorization: Bearer <apiKey>Three errors are common to every endpoint, whatever it does:
| Status | Message | Cause |
|---|---|---|
401 | Missing API key | No Authorization: Bearer header |
401 | Invalid API key | The key is unknown, revoked, or belongs to the other mode |
403 | API access is not enabled for this business | Developer API is off for your business |
403 | This IP address is not permitted to use this API key | Your allowlist is non-empty and the caller's IP is not on it |
429 | Rate limit exceeded | More than 100 requests in 60 seconds, counted per business per mode |
Send request bodies as plain JSON, exactly as shown throughout the guides, unless you turned on field-level encryption, in which case they are wrapped in an encrypted envelope.
Your key can also be narrowed to a set of IP addresses, and the rate limit behind that 429 is covered in Restrict your API key.
How is this guide?
Last updated on