> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dnclatam.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate server-side requests with a DNC LATAM Bearer API key.

`POST /v1/scrub` requires a live API key in the HTTP `Authorization` header.

```http theme={null}
Authorization: Bearer dnc_live_YOUR_KEY
```

Create and revoke keys in the [DNC LATAM dashboard](https://app.dnclatam.com).
Each key is shown only once.

## Server-side use only

Treat the API key as a production secret:

* Store it in a secret manager or encrypted environment variable.
* Send it only to `https://api.dnclatam.com`.
* Never embed it in browser, mobile, or distributed client code.
* Never commit it to source control.
* Never place it in an idempotency key, URL, log, screenshot, support ticket, or AI prompt.
* Redact `Authorization` before recording request metadata.

<Warning>
  Do not use the documentation site to test a live key. The Mintlify reference
  displays copyable examples but does not execute API requests.
</Warning>

## Request example

```bash theme={null}
curl https://api.dnclatam.com/v1/scrub \
  -X POST \
  -H "Authorization: Bearer ${DNC_LATAM_API_KEY}" \
  -H "Idempotency-Key: ${DNC_LATAM_IDEMPOTENCY_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"country":"mx","phones":["+52 55 1234 5678"]}'
```

## Authentication failures

The API returns HTTP `401` with `error: "invalid_key"` when the header is
missing, malformed, unknown, or associated with a revoked key.

```json theme={null}
{
  "error": "invalid_key"
}
```

Do not retry a `401` automatically. Verify the environment, rotate the key if
necessary, and update the secret through your normal deployment process.

## Key rotation

1. Create a new key in the dashboard.
2. Store the new value in your secret manager.
3. Deploy the configuration change.
4. Verify a synthetic request with the new key.
5. Revoke the old key.

This sequence avoids downtime and prevents the old key from remaining active
after the migration.