Authentication
subdomain.to API keys belong to an organization, are stored as hashes, and are shown in plain text only when created. Keep them on the server.
Bearer header
GET /v1/domains HTTP/1.1
Host: api.subdomain.to
Authorization: Bearer sdt_live_xxxxxxxxxxxxxxxxxxxxxxxx
Accept: application/json
Never expose an
sdt_live_…key in browser JavaScript, a mobile app, logs, or a Git repository. Use a widget session for client-side integrations.
Scopes
| Scope | Grants permission to |
|---|---|
destinations:write |
Create HTTPS destinations |
domains:write |
Create and delete customer domains |
webhooks:write |
Create webhook endpoints |
widget:write |
Issue widget sessions |
billing:write |
Create a Stripe Checkout session |
* |
Perform every operation |
Read operations require a valid key but no specific write scope.
Authentication responses
| Status | Code | Meaning |
|---|---|---|
401 |
unauthorized |
Missing, invalid, or revoked key |
403 |
forbidden |
Valid key without the required scope |
Rotation
Create a replacement key, deploy it, verify its use, then revoke the old key. A short overlap avoids downtime.