Authentication & scopes

Create tokens in Settings → Team → API tokens. Each token belongs to one team and is shown once, so copy it when it appears. Tokens start with dm_live_, so secret scanners can spot one that leaks.

Send it as a bearer token:

curl https://your-domainmanager/api/v1/domains \
  -H "Authorization: Bearer <token>" -H "Accept: application/json"

A token only has the scopes you give it:

Scope	Allows
domains:read, domains:write	list, add, remove, re-verify domains; attach and detach services
dns:read, dns:write	read and change DNS records
services:read, services:write	read and change services
groups:read, groups:write	read and change groups, members and overrides
imports:read, imports:write	start, follow and cancel imports

The token table shows when each token was last used. Revoke a token to stop it immediately.