Authentication - The Data City

Getting a key

API keys are issued by The Data City. A key:

Starts with dm_live_
Is shown in full once at creation — store it immediately
Can be revoked; revoked keys return 401

Contact support@thedatacity.com if you need a key or a rotation.

Using the key

Add an Authorization header to every match request:

Authorization: Bearer dm_live_…

Example:

curl -sS -X POST "https://datamatcher-api.thedatacity.com/api/v1/match" \
  -H "Authorization: Bearer dm_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input_name":"John Lewis plc"}'

Treat your API key like a password. Store it in an environment variable or secrets manager. Never check it into source control or include it in client-side code.

What the key is not

Dashboard login uses a separate OAuth2 password flow (POST /api/v1/login/access-token) and returns a JWT. That JWT is for the admin UI and administrative APIs. Match calls must use a dm_live_… API key. If you send a JWT to /match, expect 401.

Failure modes

Status	Meaning	What to do
`401`	Missing header, malformed key, unknown key, or revoked key	Check the key value; request a new one if revoked
`429`	Too many match requests	Back off — see Rate limits

See Errors for the full status-code matrix.

Last modified on August 20, 2026

⌘I

​Getting a key

​Using the key

​What the key is not

​Failure modes

Getting a key

Using the key

What the key is not

Failure modes