Skip to main content
DriftGuard uses API keys to authenticate all requests. Every API call (except GET /api/v1/health) must include your key in the X-API-Key header.

​
API Key Format

All DriftGuard API keys follow this format: 
dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
dg_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
The full format regex is: dg_(live|test)_<24+ characters> — meaning the total key length must be 32 characters minimum. Any key that doesn’t match this pattern will be rejected with a 401 before even reaching the auth check.
  • Never commit your API key to git or share it in public forums
  • Keys are stored as SHA-256 hashes on our servers — we cannot recover a lost key for you
  • If you believe your key is compromised, revoke it immediately from your dashboard and create a new one
  • We will never ask for your API key via email or support chat

​
Using Your API Key

Include your key in the X-API-Key header on every request: 
curl https://api.driftguard.dev/api/v1/usage \
  -H "X-API-Key: dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
The correct header name is X-API-Key. Do not use Authorization: Bearer — that format is not supported and will return a 401.

​
Key Types

PrefixEnvironmentBehaviour
dg_live_ProductionCredits are deducted per check
dg_test_DevelopmentFor local development and CI dry-runs
Use dg_test_ keys for development and CI pipelines where you don’t want to consume production credits. Switch to dg_live_ only when running checks in production.

​
Key Lifecycle

Keys are managed entirely from your dashboard. Here’s what happens at each stage:
StageWhat it means
CreatedFull key shown once — copy it immediately, it cannot be retrieved again
ActiveKey is valid and can authenticate requests
RevokedKey is deactivated — requests will return 401. Can be reactivated.
DeletedKey is permanently removed. Must be revoked before it can be deleted.
Your key is shown in full only once at creation time. After that, only the first 16 characters (the preview) are visible. Store your key in a secrets manager or environment variable immediately.

​
Rate Limits

LimitValue
Requests per minute (per key)100 req/min
New keys per hour (per user)10 keys/hour
When you exceed the per-minute rate limit, the API returns 429 Too Many Requests. Wait for the next minute window and retry.

​
Managing Keys via API

You can also create and manage keys programmatically via the /api/v1/keys endpoints. List your keys (previews only — full key is never returned after creation): 
curl https://api.driftguard.dev/api/v1/keys \
  -H "X-API-Key: dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Create a new key: 
curl -s -X POST https://api.driftguard.dev/api/v1/keys \
  -H "X-API-Key: dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "environment": "live" }'

{
  "id": "key_id_here",
  "key": "dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "environment": "live",
  "is_active": true,
  "created_at": "2026-03-01T12:00:00Z"
}
Copy the key value from this response immediately — it will not be shown again.
Revoke a key: 
curl -s -X POST https://api.driftguard.dev/api/v1/keys/{id}/revoke \
  -H "X-API-Key: dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Reactivate a revoked key: 
curl -s -X POST https://api.driftguard.dev/api/v1/keys/{id}/activate \
  -H "X-API-Key: dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Hard delete a key (must be revoked first): 
curl -s -X DELETE https://api.driftguard.dev/api/v1/keys/{id} \
  -H "X-API-Key: dg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

​
Error Codes

StatusMeaning
401Missing key, invalid key format, or key not found
403Key is valid but account has no credits remaining
429Rate limit exceeded — 100 req/min per key

​
Best Practices

  • Store keys in environment variables or a secrets manager (AWS Secrets Manager, GitHub Secrets, etc.) — never hardcode them
  • Use dg_test_ keys in all non-production environments
  • Create separate keys per service or pipeline so you can revoke individual integrations without disrupting others
  • Rotate keys periodically — revoke the old one and create a new one from the dashboard