Authentication

Every request needs an API key. Each key only does what you allowed when you made it.

Create a key

In DeNotes, open Settings → Developer API and choose Create API key. Name it after where it will be used, pick its permissions, and copy it. You will not see it again.

Keys start with dn_live_. Treat one like a password: keep it out of code you share and out of web pages.

Send the key

Put it in the Authorization header, after Bearer:

Request

curl https://beta.api.denotes.space/v1/folders \
  -H "Authorization: Bearer dn_live_YOUR_KEY"

A missing, wrong, expired or revoked key gets 401 UNAUTHORIZED.

Scopes

A key has a read scope, a write scope or both for each kind of item. Write means create and update; nothing can delete.

Resource	Read	Create and update
Notes	`notes:read`	`notes:write`
Folders	`folders:read`	`folders:write`
Files	`files:read`	`files:write`
Goals	`goals:read`	`goals:write`
Phases	`phases:read`	`phases:write`
Goal items	`items:read`	`items:write`

The API reference lists the scope each endpoint needs. Calling one without it gets 403 INSUFFICIENT_SCOPE, naming the missing scope:

Response

HTTP/1.1 403 Forbidden
WWW-Authenticate: Bearer error="insufficient_scope", scope="notes:write"

{
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This operation requires notes:write"
  },
  "requestId": "6f1c2a9e4b7d"
}

Revoke a key

Delete it from Settings → Developer API. It stops working straight away, for the REST API and the MCP server alike.