Skip to main content
Every request to the Draftable API is authenticated. This article covers what your credentials are, how to send them, and how to look after them.

​
Your credentials

A Draftable API account is issued two values: Find both at api.draftable.com/account/credentials.
The auth token is a secret. Anyone holding it can create, read and delete comparisons on your account. Never commit it to source control, never expose it in client-side code, and never include it in a URL you give to an end user.
You will see two credential sets, test and production. They are functionally identical and exist to separate your development traffic from your live traffic. See Test and production accounts.

​
Making an authenticated request

Send the auth token in an Authorization header using the Token scheme:
The API base URL is:
A complete request:
Only the auth token goes in the header. The account ID is not part of the Authorization value. The account ID is used separately, in viewer URLs and when generating viewer URL signatures.

​
With a client library

The client libraries take both values and handle the header for you:

​
Storing credentials safely

1

Keep credentials out of your codebase

Load them from environment variables or a secrets manager. The Python command line tool, for example, reads DR_ACCOUNT and DR_TOKEN.
2

Call the API from your server, never the browser

A comparison must be created by your backend. If your front end holds the auth token, anyone using your application can read it.
3

Use separate credentials per environment

Test credentials for development and CI, production credentials for live traffic.
4

Give users signed viewer URLs, not credentials

Signed viewer URLs let a user open one specific comparison for a limited time without ever seeing your auth token. This is the intended way to expose a comparison to an end user.

​
If a token is exposed

Contact support@draftable.com and ask for the token to be reset. Treat an exposed production token as an incident. Resetting a token invalidates the old one immediately, so update your configuration at the same time. Note that resetting a token also invalidates any signed viewer URLs generated with it, since the token is the signing secret.

​
Securing the account itself

The auth token protects API requests. Your Draftable account, where you view credentials, usage and account settings, is protected by your account password and can additionally be protected with multi-factor authentication. These are separate. Enabling MFA does not change how API requests authenticate, and does not require any change to your integration. See Multi-factor authentication for your Draftable API account.

​
Troubleshooting

The auth token is missing, malformed or incorrect. Check that the header reads Authorization: Token YOUR_AUTH_TOKEN, with a single space after Token and no quotes around the value. Confirm you have not accidentally used the account ID in place of the token.
Comparisons are visible only to the credential set that created them. If the comparison was created with test credentials, you must authenticate with test credentials to see it.
Signed URLs are signed with the auth token. If the token has been reset, previously generated signatures are no longer valid. Generate fresh URLs.

Getting started with the Draftable API

Test and production accounts

Multi-factor authentication