Authentication, paid access and rate limits
There are two ways to give a program access to your DailyGoal data: paste an API token into it, or connect it as an app that you approve. Both pause while you have no paid access, and you can revoke either one at any time.
The DailyGoal API is not available on the Free plan. It works with a paid plan or during a free trial. See plans.
Which one do I need?
API token
Each account has one API token. Create it in your DailyGoal settings on the web or in Preferences in the app. It starts with dg_live_, is shown once, and is stored only as a hash, so DailyGoal cannot show it again. Settings show its prefix and when it was last used.
Send it on every REST request and from header-based MCP clients:
Authorization: Bearer <your API token>Regenerating the token replaces it and stops the old one at once. Revoking it stops all header-based access. Signing out everywhere, resetting your password or deleting your account also revokes it.
Connected apps
Some AI apps add an MCP server by opening a sign-in and consent screen instead of taking a header. DailyGoal is adding support for these connected apps: each app you approve will appear in your settings with the date it connected and when it was last used, and you can revoke it on its own. The REST API accepts API tokens only; connected apps use the MCP server.
DailyGoal names an app here only after it passes an end-to-end connection test. No app has passed yet, so use an API token for now and see the MCP quickstart.
Paid access
The API needs a paid DailyGoal plan or a free trial. If your paid access ends, your token and connected apps are paused, not deleted: requests return 403 with the subscription_required code and a link to resubscribe. They work again as soon as you resubscribe, with nothing to reconnect. While paused, you can still see and revoke them in settings. Compare plans.
Rate limits
Limits apply per user and are shared by every token and connected app on the account. They use token buckets: the burst is how many requests you can make at once, and the bucket refills at the per-minute rate. get_context returns the current numbers.
| Requests | Per minute | Burst | Per day |
|---|---|---|---|
| Reads | 120 | 60 | No daily cap |
| Writes | 30 | 15 | 1,000 |
Over the limit, the API returns 429 with the rate_limited code and a Retry-After header in seconds.
Errors
REST and MCP return the same error envelope, with a stable code, a hint on what to do next and a retryable flag. The error reference lists every code.