API Access & Automation
Use the dashboard for interactive management, the CLI for terminal workflows, and the API when a script needs structured responses. API requests run with the account’s existing permissions; an API token does not grant additional access.
Hosted addresses
| Purpose | Hosted d2o address |
|---|---|
| Dashboard and browser-based CLI sign-in | https://dashboard.d2o.io |
API origin / PAAS_API_URL for scripts | https://api.d2o.io |
| REST API prefix | https://api.d2o.io/api/v1 |
| MCP endpoint | https://api.d2o.io/mcp |
| Documentation | https://docs.d2o.io |
For a self-hosted installation, obtain these addresses from your operator. They can share a hostname or use different hosts; do not assume the dashboard serves /mcp. Examples using a full origin require the https:// scheme exactly once.
Choose the right credential
| Credential | Used for | Scope and management |
|---|---|---|
Account API token (paas_…) | CLI, REST API, MCP | Acts as its owner with their permissions. Manage and revoke through Account. MCP tools are read-only, but the same token can authorize writes through the REST API. |
| Personal HTTPS push token | Git over HTTPS | Issued for the selected remote; expires after 30 days. Refresh with paas git remote --https. |
| SSH key | Git over SSH | Registered to your account; remove lost keys in Account settings or with the CLI. |
| Deployment token | Automated Git pushes | One Environment or app remote; organization-owned. Optional expiry. It cannot authenticate API or MCP requests. |
| Bucket S3 credentials | S3-compatible clients | Access to that bucket; obtain them through the bucket tooling and keep them server-side. |
| Secret reference | Configuration inside an app | Selects a stored application secret; it is not a credential for managing the platform. |
Keep automation credentials in the CI system’s secret store. Disable shell tracing around credentials and avoid printing tokens or authenticated Git URLs. Use a deployment token when a job only needs to push source.
Make an authenticated read request
Sign in locally with the CLI first:
paas login --host https://dashboard.d2o.io
Then request your account details without printing the token:
curl --fail-with-body --silent --show-error \
-H "Authorization: Bearer $(paas auth token)" \
https://api.d2o.io/api/v1/users/me
In CI, supply PAAS_API_URL=https://api.d2o.io and PAAS_API_TOKEN from the secret store, then use a CLI command such as paas whoami --json. Never commit the token. See CLI authentication for host selection and configuration.
Handle errors and collection results
Treat a 401 response as an authentication problem and 403 as a permission problem. Check the error response before retrying a failed write. For 429, wait for the response’s Retry-After interval and back off; see API rate limits.
Do not assume every list returns all records or uses the same pagination scheme. Follow the specific endpoint’s documentation; for example, audit logs use limit and offset. A successful Git push only confirms source acceptance; deployment verification is a separate step.
For external AI clients, use the MCP setup guide.