Authentication & permissions

#API key

• Format: dpk_ + 43 characters. Send it as Authorization: Bearer dpk_... or X-Api-Key: dpk_....
• Deplao stores only the SHA-256 hash of the key. Lost a key? Revoke it and create a new one.
• Each key has: scopes, allowed accounts (empty = all), allowed IPs (IP or CIDR, optional), expiry (optional), rate limit (default 0 = unlimited; set one yourself if you want), ERP role (default manager).

#Scope

See the full list at GET /api/v1/scopes. Missing scope → 403 FORBIDDEN_SCOPE. admin = every scope.

#Allowed accounts

A key restricted to certain accounts gets 403 FORBIDDEN_ACCOUNT when it calls any other account; GET /accounts returns only the allowed accounts; events and webhooks are filtered by account as well.

#Employees

An employee's login token (employee mode) can call API v1 too. The employee's module permissions are mapped to scopes (chat → chat:read/send/manage, crm → crm:*, ...), and the accounts are the ones assigned to that employee. Employees are not rate-limited.

#ERP

ERP routes go through the app's own ERP permission checks. A key acts with the ERP role set on it (owner/admin/manager/member/guest); insufficient permission → 403 FORBIDDEN_ERP.

#Key brute-force protection

When "Key brute-force protection" (Chống dò key) is on (the default), an IP that sends 20 or more invalid keys within 1 minute is blocked for 10 minutes (429 AUTH_BLOCKED). Requests with a valid key are not affected.