POST /v1/scrub and POST /v2/scrub require a live API key in the HTTP
Authorization header. Status, result, and cancellation requests require an
active key from the same organization that submitted the job.
Create and revoke keys in the DNC LATAM dashboard.
Each key is shown only once.
Server-side use only
Treat the API key as a production secret:
- Store it in a secret manager or encrypted environment variable.
- Send it only to
https://api.dnclatam.com.
- Never embed it in browser, mobile, or distributed client code.
- Never commit it to source control.
- Never place it in an idempotency key, URL, log, screenshot, support ticket, or AI prompt.
- Redact
Authorization before recording request metadata.
Do not use the documentation site to test a live key. The Mintlify reference
displays copyable examples but does not execute API requests.
Request example
Authentication failures
The API returns HTTP 401 with error: "invalid_key" when the header is
missing, malformed, unknown, or associated with a revoked key.
Do not retry a 401 automatically. Verify the environment, rotate the key if
necessary, and update the secret through your normal deployment process.
Key rotation
- Create a new key in the dashboard.
- Store the new value in your secret manager.
- Deploy the configuration change.
- Verify a synthetic request with the new key.
- Revoke the old key.
This sequence avoids downtime and prevents the old key from remaining active
after the migration.
