Authentication

The API uses a two-layer authentication model.

Layer 1 — API key

Every request must include your company API key as the X-Api-Key header.

X-Api-Key: dkp_YOUR_KEY

The key identifies your company, enforces abilities, applies the IP allowlist, and tracks rate limits. Create and manage keys in Settings → API & Webhooks.

Layer 2 — User access token (optional)

To attribute actions to a specific user, obtain a short-lived token by logging in:

curl -X POST https://app.doorknockpro.com/api/v1/auth/login \
     -H "X-Api-Key: dkp_YOUR_KEY" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -d '{"email": "[email protected]", "password": "..."}'

{
  "access_token": "eyJ...",
  "token_type": "Bearer",
  "expires_in": 28800,
  "user": { "id": 47, "name": "Agent Name", "email": "[email protected]", "role": "Agent" }
}

Pass the token on subsequent requests:

Authorization: Bearer ACCESS_TOKEN

Tokens are self-contained and stateless (8h expiry). No server-side session is stored.

Modes

Mode	Headers	Actor	Use case
User-authenticated	X-Api-Key + Authorization: Bearer TOKEN	The logged-in user	Per-user attribution, role-based access
Server-to-server	X-Api-Key only	Service account ("API Integration")	Automated syncs, Zapier, CRM connectors

Key abilities

When creating a key, select only the abilities your integration needs:

Ability	Access
leads:read	List and show leads
leads:write	Create, update, delete leads
appointments:read	List and show appointments
appointments:write	Create, update, delete appointments
territories:read	List territories and search leads within them
users:read	List and show users
lookups:read	Read lead statuses, property types, teams
webhooks:manage	Manage webhook endpoints and view deliveries