> ## Documentation Index
> Fetch the complete documentation index at: https://www.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Quickstart

> Make your first authenticated call to the Dynamic REST API in a few minutes, using a console API token.

Use the REST API when you want to work with Dynamic from a backend, a script, or any language without a Dynamic SDK. This page gets you to a first successful response.

> [!NOTE]
>
> Building a client app instead? Start with an SDK: [JavaScript](https://www.dynamic.xyz/docs/javascript/reference/quickstart.md), [Swift](https://www.dynamic.xyz/docs/swift/quickstart.md), [Kotlin](https://www.dynamic.xyz/docs/kotlin/quickstart.md), [Flutter](https://www.dynamic.xyz/docs/flutter/quickstart.md), or [Node](https://www.dynamic.xyz/docs/node/quickstart.md).

## Which token do you need

The API has two kinds of endpoint, and they take different bearer tokens.

| You are calling | Token | Where it comes from |
| - | - | - |
| Admin endpoints, acting as the environment owner | **API token**, prefixed `dyn_` | The console, once |
| SDK endpoints, acting as a signed-in user | **User JWT** | Your app, per session |

This quickstart uses an API token. For the SDK endpoints, read [Authentication](https://www.dynamic.xyz/docs/api-reference/overview.md#authentication).

## Steps

**1. Create an API token**

In the console, open the [Developer tab](https://console.dynamic.xyz/dashboard/developer/api) and click **Create Token** in the API Token section.

Name it after the system that will use it, for example `billing-service`, and grant only the scopes that system needs. See [API token permissions](https://www.dynamic.xyz/docs/platform/console/api-token-permissions.md).

> [!WARNING]
>
> Copy the token before closing the dialog. Dynamic does not store the plaintext value, so a lost token has to be replaced with a new one.

**2. Find your environment ID**

Every request is scoped to an environment. Your environment ID is in the console, and each environment has a separate sandbox and live pair. Use the sandbox one while you are trying things out.

**3. Make your first call**

Read back your own environment. A `200` confirms the token, the environment ID, and the scopes are all correct.

```bash curl theme={"system"}
curl "https://app.dynamic.xyz/api/v0/environments/$DYNAMIC_ENVIRONMENT_ID" \
  --header "Authorization: Bearer $DYNAMIC_API_TOKEN" \
  --header 'Content-Type: application/json'
```

```typescript TypeScript theme={"system"}
const response = await fetch(
  `https://app.dynamic.xyz/api/v0/environments/${process.env.DYNAMIC_ENVIRONMENT_ID}`,
  {
    headers: {
      Authorization: `Bearer ${process.env.DYNAMIC_API_TOKEN}`,
      'Content-Type': 'application/json',
    },
  },
);

if (!response.ok) {
  throw new Error(`Dynamic API returned ${response.status}`);
}

const environment = await response.json();
```

```python Python theme={"system"}
import os
import requests

response = requests.get(
    f"https://app.dynamic.xyz/api/v0/environments/{os.environ['DYNAMIC_ENVIRONMENT_ID']}",
    headers={
        "Authorization": f"Bearer {os.environ['DYNAMIC_API_TOKEN']}",
        "Content-Type": "application/json",
    },
    timeout=10,
)
response.raise_for_status()
environment = response.json()
```

> [!WARNING]
>
> Keep the token server-side. Read it from an environment variable or a secrets manager, never from client-side code or a committed file, since it carries the scopes you granted it.

**4. Call something useful**

List the users in the environment:

```bash curl theme={"system"}
curl "https://app.dynamic.xyz/api/v0/environments/$DYNAMIC_ENVIRONMENT_ID/users" \
  --header "Authorization: Bearer $DYNAMIC_API_TOKEN"
```

See [Get all users for an environment](https://www.dynamic.xyz/docs/api-reference/users/get-all-users-for-an-environment.md) for filtering and pagination.

## If it does not work

| Status | What it usually means |
| - | - |
| `401` | The token is missing, malformed, or revoked. Check the `Bearer ` prefix. |
| `403` | The token is valid but lacks the scope for this endpoint. |
| `404` | The environment ID is wrong, or belongs to another project. |

The full list is in [Standard errors](https://www.dynamic.xyz/docs/api-reference/overview.md#standard-errors).

## Next

> [card] [Authentication](https://www.dynamic.xyz/docs/api-reference/overview.md#authentication)
>
> API tokens, user JWTs, and when to use each.

> [card] [Endpoints](https://www.dynamic.xyz/docs/api-reference/overview.md)
>
> Every endpoint, grouped by resource.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.