Developers / API authentication

API authentication

Dracily uses a single secret API key for server-to-server access. You do not need a separate client ID for normal integrations.

When to use what

Method	Use for
Session cookie (browser app)	Logged-in users on dracily.com
`Authorization: Bearer drac_…`	Your backend, scripts, CI, integrations

OAuth-style client ID + client secret is only needed if you build a third-party OAuth app later. For calling Dracily’s API from your server, one API key is enough.

Create a key

Sign in → Settings → API
Create a key and copy the secret once
Store it as an environment variable (never in frontend code)

Base URL

https://api.dracily.com

Same API as https://dracily.com/v1/…. Prefer api.dracily.com for integrations.

Example header

Authorization: Bearer drac_xxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

Quota

Every scan created with an API key counts toward your organization’s plan (scans + storage), just like the Detect UI. Request history appears under Settings → API → Recent API requests.