Be first in. Get early access

AccessDiff

All documentation

API keys

An API key lets a script, a CI job or an AI agent run scans without a browser. Keys are created and revoked on Account → API keys. The free tier allows 1 active key, Starter 3, Growth 10, Agency 25.

Creating a key

  1. Open Account → API keys and press Create key.
  2. Give it a name you will recognise later, such as "CI" or "Claude Desktop".
  3. Copy the key now. It is shown once; afterwards only its first characters (accessdiff_live_3f9c…) are visible.

Keys starting with accessdiff_test_ come from a test deployment and only work there.

Using a key

Send it as a bearer token. A site scan takes one to four minutes, so give the client a five-minute timeout:

curl https://accessdiff.com/api/v1/scan \
  --max-time 300 \
  -H "Authorization: Bearer accessdiff_live_…" \
  -H "Content-Type: application/json" \
  -d '{"siteUrl": "https://example.com", "maxPages": 25}'

The response carries the snapshot summary (score, counts by impact, what changed since the previous scan of that site, the top issues with how to fix them) and a signed reportUrl for the HTML report (pdfUrl for the PDF). The snapshot is stored under the account's site record for that URL, so the next call shows the diff.

A quick scan of one page takes about 20 seconds:

curl https://accessdiff.com/api/v1/quick-scan \
  -H "Authorization: Bearer accessdiff_live_…" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/pricing"}'

X-API-Key: <key> works as well. Every successful site scan counts one site scan and every quick scan one quick scan against the account's monthly allowances, the same allowances the web app uses. The response's usage object tells you how many remain.

Rate limits

60 requests per minute per key by default. The X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers are on every response; a 429 includes Retry-After in seconds.

Revoking a key

Press Revoke next to the key. Requests with a revoked key get HTTP 401 immediately. Revoke and recreate a key if it was ever pasted somewhere public.

Errors

Every error is JSON: {"error": {"code": "...", "message": "..."}}. Codes: unauthorized (401), invalid_input (400, with details), payment_required (402, allowance used up), conflict (409, a scan of that site is already running), rate_limited (429), internal (500, retry with backoff).