Apps and keys
An app is your bot or website as dzbot sees it. It holds everything that bot uses — its API keys, its Sign in with dzbot and its webhooks. Delete the app and all of it stops working at once.
// SetupCreate an app
In your server's admin area, open Developers and create an app with a name (players see it when they sign in). An app belongs to your organization; enable it for the servers it works on.
| Part | For |
|---|---|
| Rights ceiling | The access rights the app may ever use, wildcards included (player.*, admin.tickets.*). No key, token or webhook of the app gets past it |
| Keys | Server-to-server access for your bot or backend, one server each — see below |
| Sign in with dzbot | Redirect URIs, browser origins and the client secret — see Sign in with dzbot |
| Webhooks | Endpoints that receive events — see Webhooks |
Managing apps takes the admin.developers.* rights. Apps work while the server is on dzbot Pro; on dzbot Free their keys and tokens are refused and their webhooks stop.
// KeysAPI keys
A key starts with dzk_ and is shown once — copy it when you create it, keep it out of code and public channels, and delete it to revoke it at once. A key belongs to one server and carries its own access rights inside the app's ceiling. On a server with ticket support levels it also needs the matching admin.tickets.level_<id> right to see tickets.
curl "https://api.dzbot.de/api/developer/me" \ -H "Authorization: Bearer dzk_your_key_here" \ -H "X-Server-Subdomain: your-server"
Keys are secrets: use them on a server only. For a website that calls dzbot from the browser, use Sign in with dzbot with a public client.
// Fair useRate limits
| Limit | Requests |
|---|---|
| Per key or per signed-in token | 120 per minute |
| Per app, all its keys and tokens together | 600 per minute |
Over the limit, the API answers 429 with Retry-After in seconds. Use webhooks or live events instead of polling; for data without an event, once a minute is plenty.