API Request Authentication

How to authenticate your API requests to Devdraft.

All requests to the Devdraft API must include your client key and client secret in the request headers. Both are required on every call.

x-client-key: <YOUR_CLIENT_KEY>
x-client-secret: <YOUR_CLIENT_SECRET>

You can generate and manage your API keys from Settings → App Settings in the Devdraft Console.

Header	Required	Description
x-client-key	Yes	Your public client key. Identifies your account
x-client-secret	Yes	Your secret key. Authenticates the request
Idempotency-Key	No	A unique key to safely retry requests without duplication

Error	Status	Meaning
authentication_error	401	Missing or invalid credentials
permission_error	403	Valid credentials but insufficient permissions

Never expose your client secret in frontend code, mobile apps, or public repositories. Store it as a server-side environment variable only.