API documentation
Authentication
The Demarky API uses OAuth 2.0 bearer access tokens. All authenticated resource requests require an installation token in the Authorization header.
Installation tokens
Public applications use the authorization-code flow with PKCE and explicit seller consent. A successful token exchange returns a short-lived installation access token plus a rotating refresh token. Each installation token is bound to exactly one account.
| Property | Description |
|---|---|
| Access-token prefix | dmk_at_live_ |
| Refresh-token prefix | dmk_rt_live_ |
| Scopes | Resource-granular read, write, and page deployment permissions |
| Account binding | Exactly one account_id per installation |
| Access-token expiry | 10 minutes |
Making authenticated requests
Include the access token in the Authorization header:
curl -H "Authorization: Bearer dmk_at_live_xxx" https://api.demarky.ai/v1/accounts/acct_0123456789abcdefghjkmnpqrs/pagesScopes
Each grant is assigned one or more scopes that determine which operations its tokens can perform:
| Scope | Permissions |
|---|---|
products:read | List and retrieve products |
products:write | Create, update, and delete products |
pages:read | List and retrieve pages, jobs, and deployments |
pages:write | Create, update, and delete pages |
pages:deploy | Deploy landing pages |
leads:read | List and retrieve leads |
leads:write | Create and update leads |
Attempting an operation without the required scope returns a 403 Forbidden response with code insufficient_scope.