Authentication

The Integration API authenticates business accounts with an API key. Do not use dashboard session cookies for try-on traffic.

Create an API key

1. Sign in to the dashboard (invite-only account).
2. Open API keys and create a key.
3. Copy the secret immediately. It is shown once; later list views only show a masked form.
4. You may hold up to 10 active keys. Revoke unused keys in the dashboard.

Send the key on every request

Use either header (equivalent):

X-API-Key: YOUR_API_KEY

Authorization: Bearer YOUR_API_KEY

Example:

curl -sS "https://api.drapeiton.com/v1/credits" \
  -H "X-API-Key: YOUR_API_KEY"

Missing or invalid keys receive an unauthorized error in the standard error envelope.

Blocked accounts

If an administrator blocks your account, Integration API try-on and dashboard access are refused until the account is unblocked.

Security tips

• Store keys only on trusted servers; never ship production keys in mobile or browser apps that end users can extract.
• Rotate keys by creating a new key, deploying it, then revoking the old one.
• Prefer separate keys for staging and production if you use multiple environments.

Related

• Quickstart
• API Reference