Authentication

All requests to the Dash Open API are authenticated using a Bearer token. You obtain the token by exchanging a client_key + client_secret pair at the token endpoint.

⚠

Keep your secret server-side. A leaked client_secret can mint live tokens and dispatch real vehicles. Treat it like a database password. The Next Portal can't reset or rotate a secret today — if you suspect one is exposed, contact the Dash team.

Client credentials

Find your credentials in the Dash Next Portal — the API Keys for Host to Host card in Sandbox mode, or under Developers → API Key on Production. Each environment (Sandbox, Production) issues its own pair.

client_keystringrequired

Public identifier for your provider workspace. Example: SAMPLE_CLIENT.

client_secretstringrequired

Secret companion to the key. Shown once at creation; Dash only stores a hash. Contact the Dash team to rotate — the Portal has no self-service reset yet.

Token endpoint

POST/v1/auth/providers/token

Request

curl https://api.dashelectric.co/v1/auth/providers/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_key":    "SAMPLE_CLIENT",
    "client_secret": "random_and_unique_secret_key"
  }'

200 OK

{
  "status":  "OK",
  "message": "Berhasil dibuat",
  "data": {
    "token": "random_and_unique_token"
  }
}

401 Unauthorized

{
  "status":  401,
  "message": "Tidak punya akses",
  "errors": [
    { "message": "Tidak punya akses" }
  ]
}

400 Bad Request

Returned when client_key or client_secret is absent from the body. An empty-string value counts as present, so it falls through to 401 instead.

{
  "status":  400,
  "message": "Terjadi kesalahan pada isian",
  "errors": [
    { "field": "client_key", "message": "Field \"client_key\" tidak boleh kosong" }
  ]
}

Response fields

A successful exchange returns a status / message / data wrapper. The token lives at data.token, not at the top level. This envelope is specific to the token endpoint — the delivery endpoints return their own shape.

statusstringalways

Literal "OK" on success — a string here, not the numeric HTTP code. Error responses return a numeric status.

messagestringalways

Indonesian copy. "Berhasil dibuat" on success.

data.tokenstringalways

Access token to send as the Bearer token on every subsequent request. Treat it as opaque — mint a new one when it expires, there is no refresh endpoint.

Bearer authentication

Pass the token in the Authorization header on every subsequent request:

Header

Authorization: Bearer <your_access_token>

cURL

curl https://api.dashelectric.co/express/v1/deliveries/DE-1727921269869 \
  -H "Authorization: Bearer $DASH_TOKEN"

Node.js

const res = await fetch(
  "https://api.dashelectric.co/express/v1/deliveries/" + deliveryID,
  { headers: { Authorization: `Bearer ${token}` } }
);

Sandbox vs Production

Both environments share the same host. The credential pair you exchange decides which one your token belongs to.

Sandboxtesting

Portal: next-portal.dashelectric.co. By invitation only. No real driver assignment, no charges.

Productionlive

Portal: next-portal.dashelectric.co. Real drivers, real charges. Use the production credential pair.

ⓘ

The legacy sandbox-api.dashelectric.co host was deprecated on 21 May 2026 and will start returning 410 Gone on 21 Nov 2026. New integrations must use the unified base URL.