Introducing API keys: create sites from scripts and CI

Browser login is fine on your laptop. It breaks down the moment a pipeline, a cron job, or an agent needs to ship a folder. People pasted personal tokens into secrets managers, shared one workstation login, or skipped automation entirely.

Dropway already turns a folder into a live URL from the CLI. API keys make that loop safe to run without a human in the browser: create a key, store it as a secret, revoke it when the job is done.

Each key belongs to your account and can authenticate the same CLI flows you use after dropway login: create a site with --new, deploy a folder, list sites, and the rest of the non interactive commands. DROPWAY_API_KEY takes precedence over a stored browser login when both are present.

Open Settings, then API keys. Create a key, give it a label you will recognize later, and copy the secret once. Dropway only shows the full value at creation time.

Revoke a key from the same page when a script, laptop, or CI job should lose access. New deploys with that secret fail immediately.

Export the key and run the same deploy commands you already know. With --new, the CLI creates the site as part of the deploy.

export DROPWAY_API_KEY=dw_...
dropway deploy ./dist --new --site my-docs --send

In CI, store the key as a secret named DROPWAY_API_KEY (or map your secret into that variable). No browser step, no stored credentials file on the runner.

Create a key, set DROPWAY_API_KEY, and ship a folder with --new. You get a live, access controlled URL from a script the same way you would from an interactive login.