API Quickstart

Use the REST API when you want to work with Dynamic from a backend, a script, or any language without a Dynamic SDK. This page gets you to a first successful response.

Building a client app instead? Start with an SDK: JavaScript, Swift, Kotlin, Flutter, or Node.

Which token do you need

The API has two kinds of endpoint, and they take different bearer tokens.

You are calling	Token	Where it comes from
Admin endpoints, acting as the environment owner	API token, prefixed `dyn_`	The dashboard, once
SDK endpoints, acting as a signed-in user	User JWT	Your app, per session

This quickstart uses an API token. For the SDK endpoints, read Authentication.

Steps

Create an API token

In the dashboard, open the Developer tab and click Create Token in the API Token section.Name it after the system that will use it, for example billing-service, and grant only the scopes that system needs. See API token permissions.

Copy the token before closing the dialog. Dynamic does not store the plaintext value, so a lost token has to be replaced with a new one.

Find your environment ID

Every request is scoped to an environment. Your environment ID is in the dashboard, and each environment has a separate sandbox and live pair. Use the sandbox one while you are trying things out.

Make your first call

Read back your own environment. A 200 confirms the token, the environment ID, and the scopes are all correct.

curl "https://app.dynamic.xyz/api/v0/environments/$DYNAMIC_ENVIRONMENT_ID" \
  --header "Authorization: Bearer $DYNAMIC_API_TOKEN" \
  --header 'Content-Type: application/json'

const response = await fetch(
  `https://app.dynamic.xyz/api/v0/environments/${process.env.DYNAMIC_ENVIRONMENT_ID}`,
  {
    headers: {
      Authorization: `Bearer ${process.env.DYNAMIC_API_TOKEN}`,
      'Content-Type': 'application/json',
    },
  },
);

if (!response.ok) {
  throw new Error(`Dynamic API returned ${response.status}`);
}

const environment = await response.json();

import os
import requests

response = requests.get(
    f"https://app.dynamic.xyz/api/v0/environments/{os.environ['DYNAMIC_ENVIRONMENT_ID']}",
    headers={
        "Authorization": f"Bearer {os.environ['DYNAMIC_API_TOKEN']}",
        "Content-Type": "application/json",
    },
    timeout=10,
)
response.raise_for_status()
environment = response.json()

Keep the token server-side. Read it from an environment variable or a secrets manager, never from client-side code or a committed file, since it carries the scopes you granted it.

Call something useful

List the users in the environment:

curl

curl "https://app.dynamic.xyz/api/v0/environments/$DYNAMIC_ENVIRONMENT_ID/users" \
  --header "Authorization: Bearer $DYNAMIC_API_TOKEN"

See Get all users for an environment for filtering and pagination.

If it does not work

Status	What it usually means
`401`	The token is missing, malformed, or revoked. Check the `Bearer` prefix.
`403`	The token is valid but lacks the scope for this endpoint.
`404`	The environment ID is wrong, or belongs to another project.

The full list is in Standard errors.

Authentication

API tokens, user JWTs, and when to use each.

Endpoints

Every endpoint, grouped by resource.

Last modified on September 21, 2026

Learn

Build with

Which token do you need

Steps

If it does not work

Next

Authentication

Endpoints

​Which token do you need

​Steps

​If it does not work

​Next

Authentication

Endpoints

Which token do you need

Steps

If it does not work

Next