Drıftstack docs
Docs

‘Do this in the Driftstack dashboard’ (API key cannot)

You might be here because: “Do this in the Driftstack dashboard.” · “Do this in the web dashboard” · “dashboard-only” · “403 Dashboard only” · “can’t create an API key with my API key” · “checkout from the API” · “accept the invite from my script” · “why do I have to use the website” · “the SDK raises DashboardOnlyError”

Short answer

Some actions are done by a signed-in person in the dashboard and are refused to every API key, desktop credential and OAuth token with 403 dashboard-only, “Do this in the Driftstack dashboard.”. Sign in to the dashboard in a browser and do it there; nothing is wrong with your key.

Check first

  • Which action? The dashboard-only ones are: checkout and the billing portal; starting a crypto checkout; editing and cancelling an existing crypto order (the dashboard has no button for these two today); creating and rotating API keys; inviting a teammate, removing one, and accepting a team invite; accepting the legal terms; signing other dashboard sessions out; choosing how paid AI is billed (the AI source) and the paid-AI spend settings; adding or removing saved site credentials; removing a stored Verification checks (solver) key on Settings. Two-factor changes, removing a linked sign-in, device binding, two-factor step-up and OAuth consent refuse the same way.
  • In the desktop app the wording is “Do this in the web dashboard at …”, shown for inviting or removing a teammate, the AI-spend settings and checkout.
  • A 403 that says “Not permitted with a device-provisioned key” is the desktop app’s own credential being refused — a different page (see Related).

Likely causes and fixes

  1. You automated something that is meant to be done by a person. This is policy, not an outage: without it any key with the right scope could do these, so a leaked full-access key could, for example, mint more keys to keep itself alive. Fix: open the dashboard and do the action there; the rest of your automation is unaffected.

  2. Key creation or rotation from a script. Not possible by design; rotate from the keys page, where the old key keeps working for up to 24 hours (less if it was already set to expire sooner) while you roll the new one out; the exact time is under “Old key valid until”. If the key had an expiry date, the new key keeps that date.

  3. You got 401 or a scope error instead. An anonymous call still gets 401, and a key without the needed scope still gets its scope refusal — the dashboard-only check runs after both.

  4. Your code retries it. Don’t: the SDKs list dashboard-only as not retryable. Catch it and point the person at the dashboard.

If it still fails

If the dashboard itself refuses the same action, that is a different problem: press Talk to a person in this chat (or open Help) and include the account email, the action, and the exact sentence the dashboard showed. Nothing here requires an account action.