Authentication

The Daily REST API uses API keys to authenticate requests. Your API key is available in the Developers section of the Daily dashboard.

Admins can view and regenerate the API key.
Members do not have access to the API key. Request it from an Admin, or ask an Admin to change your role to Admin. See dashboard user roles for what each role can do.

Using Daily through Pipecat Cloud? You have a separate, integrated Daily API key that comes with your Pipecat Cloud account. Find it under Settings → Daily (WebRTC) in the Pipecat Cloud dashboard. It has the same capabilities as a key from dashboard.daily.co, and 1:1 voice minutes are free when your agent runs on Pipecat Cloud. The two keys belong to different accounts, so a recording or session created with one key won’t show up when you query with the other. See the Daily WebRTC guide for details.

Staging and testing

Daily doesn’t support adding a second domain to an existing account. To set up a staging environment, sign up for a separate Daily account using a variant of your domain name (e.g. yourdomain-dev). The new account’s API key is immediately available under the Developers tab in the dashboard.

Making authenticated requests

Include your API key in the Authorization header of every request:

curl --request GET \
  --url https://api.daily.co/v1/rooms \
  --header 'Authorization: Bearer DAILY_API_KEY'

Each API key is scoped to a single Daily domain.

Never include your API key in client-side browser code. Treat it like a password.

HTTPS is required for all Daily REST API requests.

Authentication errors

Condition	HTTP status	`error` value
`Authorization` header missing or malformed	`400`	`authorization-header-error`
API key is not valid	`401`	`authentication-error`

Rate limits

Daily rate-limits the API to ensure stability for all users. If you exceed the limits, you’ll receive a 429 response with error: "rate-limit-error". Limits are counted per API key, per endpoint.

Endpoints	Limit
Most endpoints, including `POST /rooms`, `DELETE /rooms/:name`, `GET /rooms`, presence, and webhooks	99 req per 5-second window
Analytics and data endpoints, including `GET /meetings`, `GET /recordings`, `GET /usage`, API and webhook logs, transcripts, the batch processor, phone numbers, verified caller IDs, SIP trunks, and domain dial-in config	49 req per 30-second window
Start dial-out, start dial-in, and start live streaming (these three share one budget)	4 req per 5-second window
Start recording (its own separate budget)	4 req per 5-second window
Batch room create and delete (`POST /batch/rooms`, `DELETE /batch/rooms`)	9 req per 30-second window. Each request can include up to 1000 rooms, and creates still count toward your account’s room limit.
Create a meeting token (`POST /meeting-tokens`)	No per-endpoint limit

These are the number of requests that succeed in each window. The next request in the same window gets a 429. Starting dial-out, starting dial-in, and starting a live stream all pull from the same budget. If you start a dial-out and a live stream back to back with the same API key, both count against that one budget. Starting a recording is counted on its own. A recording start does not use up any of the budget shared by dial-out, dial-in, and live streaming. Handle 429 responses by retrying with exponential backoff. Contact support if you need higher limits.

​Staging and testing

​Making authenticated requests

​Authentication errors

​Rate limits

Staging and testing

Making authenticated requests

Authentication errors

Rate limits