DYCRYPT documentation
Overview
Issue, renew, revoke and manage licences in one organisation.
DYCRYPT organisation API 2.6.2
Section titled “DYCRYPT organisation API 2.6.2”Everything the DYCRYPT console does inside an organisation, over HTTP.
Two credentials appear in this document and they are not interchangeable.
- An organisation token (
dyc_…) is a server-side secret. It issues, renews and revokes. It belongs in your deployment secrets and must never ship inside the application you distribute. - A check token (
dycc_…) belongs to one product and does ship inside the distributed application. It reaches exactly two endpoints,/checkand/fetch, and is treated as identifying rather than secret.
What makes a check answer trustworthy is not the token but the receipt — a
signature by the product’s own key. See the receipt property of
CheckResponse.
Not in this document: the platform control plane — the organisation registry, plan assignment, platform administrators, service health. An organisation token cannot reach it whatever it was granted.
Authentication
Section titled “Authentication”orgToken
Section titled “orgToken”An organisation API token, dyc_<id>_<secret>, minted by a signed-in
organisation administrator at Settings → API tokens.
A token carries capabilities, not a role — <resource>:<read|write> —
and write implies read. It is measured against its scopes and never
against the role of whoever created it, so neither model can be used to
smuggle permission out of the other.
Only its SHA-256 is stored. SHA-256 rather than bcrypt on purpose: the secret is 256 bits of CSPRNG output, so there is no guessable structure a slow hash would defend against, and every request would otherwise pay the cost.
Whatever it was granted, a token can never mint tokens, cross into another organisation, reach the platform control plane, change a password, or register a passkey.
Security scheme type: http
checkToken
Section titled “checkToken”A product’s check credential, dycc_<checkId>_<secret>, minted with the
product and shown once.
It ships inside the application you distribute, so treat it as identifying rather than secret — anyone holding your software can extract it. What it buys is that the endpoint is no longer anonymous, that a product’s check access can be revoked without reissuing its licences, and that rate limits apply per product as well as per address.
It is not what makes an answer trustworthy. The receipt is.
Security scheme type: http
session
Section titled “session”The console’s own session cookie. Used here for the endpoints closed to tokens: managing tokens, changing a password, passkeys.
Security scheme type: apiKey
Cookie parameter name: JSESSIONID