API keys · Driftstack

Use it now

curl https://api.driftstack.dev/v1/account/me \
  -H "Authorization: Bearer ds_live_<your-key>"

# TypeScript SDK
npm i @driftstack/sdk

Replace ds_live_<your-key> with the key you copy on creation — the plaintext is shown once and never stored.

Key created — copy it now

This is the only time the full key is shown. Store it in your secret manager before dismissing.

API key rotated

Copy the new plaintext now — it won't be shown again. The previous key keeps working for the grace window below; deploy the new key everywhere before then or requests using the old key will start returning 401.

Rotated from

New plaintext

Old key valid until

API keys are scrypt-hashed at rest. Driftstack staff cannot read your keys — a database breach surfaces hashes, not keys. If a key leaks, revoke + rotate; no admin recovery path exists.

No API keys yet

Create a key to start driving sessions from your code. Most customers create one key per environment (dev / staging / prod) — scopes are key-level, so a leaked dev key can't touch prod state.

Scopes: read (list/get-only), write (create sessions, navigate, interact), account_owner (manage webhooks, billing, mint other keys). Always create the narrowest-scoped key the job needs.

Create a new API key

Key created — copy it now

API key rotated

No API keys yet