The DJfindr API uses bearer tokens to authenticate requests. Tokens look like
djf_sk_ followed by 32 characters.
Authorization: Bearer djf_sk_...Tokens are issued by DJfindr — there is no self-serve endpoint. Contact us
to request one, and say what you are building; the token is scoped to the public
catalog and to nothing else.
Your token is shown once, when it is created, and is stored only as a hash
afterwards. Neither we nor you can recover the value later — if you lose it, we
rotate it and issue a new one.
Treat the token as a secret. Do not embed it in client-side code or a mobile
app, where anyone can read it out of the bundle; keep it server-side, in your
platform's secrets store or an environment variable, and have your server call
the API on your users' behalf.
Make all requests over HTTPS. Requests without a valid token fail with 401.
curl https://api.djfindr.com/prod/v1/public/djs?occasion=wedding \
-H "Authorization: Bearer djf_sk_..."Why a request is refused
A 401 means the token was missing, unrecognised, or has been disabled. The
response is identical in all three cases, deliberately — an unauthenticated
caller learns nothing about which one applies.
A 403 means the token is valid but not permitted on that part of the API.
You will only see this if you hold a token for a DJfindr account tree and call
it against the wrong one; a public token never encounters it.