Authentication

The Drumtix API uses API keys for authentication. Every request must include a valid key in the Authorization header.

API keys require a Pro plan. Free plan organisations can generate keys but requests will be rejected until the plan is upgraded.

Generating an API key

Keys are prefixed with dk_live_ so they’re easy to identify if one leaks.

Pass your key as a Bearer token in the Authorization header:

curl https://app.drumtix.com/api/v1/events \
  -H "Authorization: Bearer dk_live_YOUR_KEY_HERE"

When generating a key, select only the scopes your integration actually needs:

Scope	Description
`read`	Read access to all data — events, tiers, orders, tickets, attendees, check-ins, and promoter payouts
`write`	Create and update events and ticket tiers
`checkins:write`	Record door check-ins via `POST /checkins` — intended for custom check-in apps

A key can hold multiple scopes. For example, a door management app would need read + checkins:write but not write.

Status	Meaning
`401 Unauthorized`	Missing or invalid key
`403 Forbidden`	Key is valid but lacks the required scope for this endpoint
`429 Too Many Requests`	Rate limit hit — see `Retry-After` header

If a key is compromised:

Revoked keys are invalidated immediately.

Store keys in environment variables, never in source code or public repositories
Never expose keys in client-side JavaScript
Use the narrowest scope that meets your integration’s needs
Rotate keys periodically as a best practice