Drıftstack docs
Docs

‘Do this in the Driftstack dashboard’ (API key cannot)

You might be here because: “Do this in the Driftstack dashboard.” · “Do this in the web dashboard” · “dashboard-only” · “403 Dashboard only” · “can’t create an API key with my API key” · “checkout from the API” · “accept the invite from my script” · “why do I have to use the website” · “the SDK raises DashboardOnlyError”

Short answer

Some actions are done by a signed-in person in the dashboard and are refused to every API key, desktop credential and OAuth token with 403 dashboard-only, “Do this in the Driftstack dashboard.”. Sign in to the dashboard in a browser and do it there; nothing is wrong with your key.

Check first

  • Which action? The dashboard-only ones are: checkout and the billing portal; editing and cancelling an existing crypto order (the dashboard has no button for these today); creating and rotating API keys; accepting a team invite; accepting the legal terms; signing other dashboard sessions out. Two-factor changes, removing a linked sign-in, device binding, two-factor step-up and OAuth consent refuse the same way.
  • In the desktop app the wording is “Do this in the web dashboard at …”, shown for inviting or removing a teammate, the AI-spend settings and checkout.
  • A 403 that says “Not permitted with a device-provisioned key” is the desktop app’s own credential being refused — a different page (see Related).

Likely causes and fixes

  1. You automated something that is meant to be done by a person. This is policy, not an outage: without it any key with the right scope could do these, so a leaked full-access key could, for example, mint more keys to keep itself alive. Fix: open the dashboard and do the action there; the rest of your automation is unaffected.

  2. Key creation or rotation from a script. Not possible by design; rotate from the keys page, where the old key keeps working for 24 hours while you roll the new one out.

  3. You got 401 or a scope error instead. An anonymous call still gets 401, and a key without the needed scope still gets its scope refusal — the dashboard-only check runs after both.

  4. Your code retries it. Don’t: the SDKs list dashboard-only as not retryable. Catch it and point the person at the dashboard.

If it still fails

If the dashboard itself refuses the same action, that is a different problem: press Talk to a person in this chat (or open Help) and include the account email, the action, and the exact sentence the dashboard showed. Nothing here requires an account action.