Skip to main content

Authentication

Use this page when you need to create a BF export API key, send the correct auth header, or diagnose request failures before job processing starts.

How Access Works​

The public Bulk Fill export-job API uses BF export API keys sent as Bearer tokens:

Authorization: Bearer doqlo_bfexp_<public_id>.<secret>

Current base URL:

https://api.doqlo.com

POST /v1/bulkfill/export-jobs also requires Idempotency-Key. X-Request-Id is optional tracing only. Read-only GET requests do not require either header.

Create A BF Export API Key​

Create and manage BF export API keys from your authenticated Doqlo account page.

Current key rules:

  • API keys are available on Business and Scale
  • the full secret is shown only once at creation time
  • current TTL options are 30, 90, 180, or 365 days
  • an account can hold up to 5 non-expired, non-revoked keys
  • the account page keeps all active keys visible and shows only the 5 most recent non-active keys in its history section

Account Management Limits​

The account-side key-management routes have their own mutation limits. These limits are separate from the public export-job API limits:

  • create key: 3 / 10 minutes, 10 / hour, 30 / day per account
  • revoke request: 10 / 10 minutes, 30 / hour per account
  • successful creates plus state-changing revokes share a 50 / day budget per account

Repeating revoke on an already revoked key remains a no-op. Those retries are still subject to the revoke-request limits, but they do not consume the shared daily mutation budget.

Send The Auth Header​

Example request headers:

Authorization: Bearer doqlo_bfexp_<public_id>.<secret>
Idempotency-Key: 2f6403c7-4e52-4c7b-b435-96542ccbf4bc
X-Request-Id: support-create-001

If you omit X-Request-Id, Doqlo generates one and returns it in the response header.

Minimal authenticated request example:

curl https://api.doqlo.com/v1/bulkfill/export-jobs/$JOB_ID \
  -H "Authorization: Bearer $DOQLO_BF_EXPORT_API_KEY"

Common Authentication Failures​

CodeHTTP statusMeaning
BF_EXPORT_API_KEY_REQUIRED401Missing header or malformed Bearer format
BF_EXPORT_API_KEY_INVALID401Token was parsed but did not verify
BF_EXPORT_API_KEY_REVOKED403Key was revoked
BF_EXPORT_API_KEY_EXPIRED403Key expired
BF_EXPORT_API_KEY_INACTIVE403Key exists but the account is not currently eligible for API use
RATE_LIMITED429Request hit a configured public API rate limit

Security Guidance​

  • Keep BF export API keys on the server side.
  • Do not hardcode keys into browser code or mobile apps.
  • Do not commit keys to Git or store them in shared chat logs.
  • Rotate keys if a secret is exposed.
  • Revoke keys you no longer use.