Get an Access Token

Every Dodil API call carries a bearer token. The dodil CLI obtains one for you with dodil auth login, but applications and services authenticate directly — no CLI required. There are two programmatic options.

Option A — API key (recommended)

Skip tokens entirely: issue a Dodil API key and send the dk_… token itself as the bearer value on every request — no exchange, no refresh, nothing expires under you. This is the simplest option and covers the control-plane APIs and all DataK³ data wires — but not edge/worker endpoints such as direct Ignite invoke, which cannot verify dk_ keys (see where API keys work):


dodil auth apikey issue --name my-app --role k3.editor   # secret shown once
 
curl -H "Authorization: Bearer dk_..." https://api.data.dodil.io/...

The key can also be the password in Basic auth (username ignored), and its public half doubles as an S3 access key ID. See API Keys for issuance, scoping, rotation, and revocation.

Option B — OAuth client-credentials (short-lived JWTs)

Use this when you need a short-lived JWT — a compliance requirement for expiring credentials, a client that already speaks OAuth, or a caller that targets edge/worker endpoints (e.g. direct Ignite invoke), where only JWTs are accepted. Because a JWT is verified against public JWKS, it works everywhere — control plane, data wires, and edge. You authenticate with a Service Account using the standard OAuth 2.0 client-credentials grant. Dodil IAM is OpenID Connect (Keycloak), in the dodil realm.

The token endpoint


https://id.dodil.io/realms/dodil/protocol/openid-connect/token

POST it grant_type=client_credentials with your Service Account’s client_id (the ServiceAccountID) and client_secret. The response’s access_token is a JWT you send as Authorization: Bearer <token>.

Create a Service Account and its secret first — see Service Accounts. Keep the secret out of source control (use an env var / secret manager).

Request a token

The examples below read the credentials from DODIL_SERVICE_ACCOUNT_ID / DODIL_SERVICE_ACCOUNT_SECRET.

curl


curl -s -X POST \
  https://id.dodil.io/realms/dodil/protocol/openid-connect/token \
  -d grant_type=client_credentials \
  -d client_id="$DODIL_SERVICE_ACCOUNT_ID" \
  -d client_secret="$DODIL_SERVICE_ACCOUNT_SECRET" | jq -r .access_token

Python


import os, requests
 
TOKEN_URL = "https://id.dodil.io/realms/dodil/protocol/openid-connect/token"
 
def get_token() -> str:
    resp = requests.post(TOKEN_URL, data={
        "grant_type": "client_credentials",
        "client_id": os.environ["DODIL_SERVICE_ACCOUNT_ID"],
        "client_secret": os.environ["DODIL_SERVICE_ACCOUNT_SECRET"],
    })
    resp.raise_for_status()
    return resp.json()["access_token"]

Node.js


const TOKEN_URL =
  "https://id.dodil.io/realms/dodil/protocol/openid-connect/token";
 
export async function getToken() {
  const body = new URLSearchParams({
    grant_type: "client_credentials",
    client_id: process.env.DODIL_SERVICE_ACCOUNT_ID,
    client_secret: process.env.DODIL_SERVICE_ACCOUNT_SECRET,
  });
  const res = await fetch(TOKEN_URL, { method: "POST", body });
  if (!res.ok) throw new Error(`token request failed: ${res.status}`);
  return (await res.json()).access_token;
}

Go


import (
    "context"
    "os"
 
    "golang.org/x/oauth2/clientcredentials"
)
 
func getToken(ctx context.Context) (string, error) {
    cfg := clientcredentials.Config{
        ClientID:     os.Getenv("DODIL_SERVICE_ACCOUNT_ID"),
        ClientSecret: os.Getenv("DODIL_SERVICE_ACCOUNT_SECRET"),
        TokenURL:     "https://id.dodil.io/realms/dodil/protocol/openid-connect/token",
    }
    tok, err := cfg.Token(ctx)
    if err != nil {
        return "", err
    }
    return tok.AccessToken, nil
}

Use the token

REST / gRPC APIs — send Authorization: Bearer <access_token>.
DataK³ wire adapters — the same token authenticates the data-plane wires: as the password on the Postgres and Bolt doors, and as Authorization: Bearer (or an api-key) on the Qdrant, Pinecone, and GraphQL doors. See DataK³ Connect & Adapters .

The response includes expires_in (seconds). Tokens are short-lived — cache the token and request a new one shortly before it expires rather than calling the endpoint on every request.