Authentication
Personal API keys, their permissions and rate limits.
API keys
Every request needs a personal API key in the Authorization header:
Authorization: Bearer dl_…Create keys in Daylite under Settings → Developer. Give each key a name for the tool that uses it, such as "Claude Code" or "Home automation", so you can revoke it on its own later.
- A key is shown once, when it is created. Daylite stores only a hash.
- A key acts as you. Anyone who has it can read your tasks, so keep it out of source control.
- Revoking a key stops it immediately.
- You can have up to 20 keys.
Account passwords and app sessions are never accepted by the API, and API keys cannot sign in to the Daylite apps.
Permissions
| Access | Permissions | Allows |
|---|---|---|
Read only | data:read | Every GET endpoint |
Read & write | data:read, data:write | Reads, and writes when added |
A request that needs a permission the key does not have returns 403 forbidden.
Rate limits
Each key can make 120 requests per minute. Over the limit, the API returns 429 with a
Retry-After header giving the seconds to wait:
HTTP/1.1 429 Too Many Requests
Retry-After: 18
{ "error": { "code": "rate_limited", "message": "Too many requests for this API key. Retry later." } }