Drata

C Drata platform

Workloads call the Drata API with a static API key or an OAuth client_credentials app whose client secret mints 24-hour tokens; there is no federation, so a long-lived secret always sits at the root. Keys are scoped and show last use, but Never is an allowed expiry, keys cannot be managed by API and GitHub does not revoke leaked ones. Into AWS Drata assumes a role with an external ID; GCP needs a service account JSON key and Azure a client secret.

Docs: help.drata.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound C

How a workload running anywhere authenticates to this product.

OAuth 2.0 client credentials against Drata's Auth0 tenant: an OAuth Application created in Settings yields a client ID and client secret that mint short-lived bearer tokens for the Public API v2 (and the MCP server). The alternative is a static API key sent as a bearer token.

help.drata.com checked 2026-10-22
“Learn how to configure and use OAuth 2.0 Client Credentials to securely authenticate API requests to Drata, which is the recommended method for machine-to-machine and enterprise integrations.”
help.drata.com checked 2026-10-22
“Instead of using a long-lived API key, OAuth allows you to generate short-lived access tokens with specific permissions (scopes).”
help.drata.com checked 2026-10-22
“<CLIENT_SECRET>: The only value you need to manually provide.”
help.drata.com checked 2026-10-22
“OAuth Applications are created per tenant, and represent an integration identity (not an individual user).”
help.drata.com checked 2026-10-22
“Store Client Secrets in a secrets manager”
developers.drata.com checked 2026-10-22
“OAuth 2.0 access token. For the client credentials flow, set `audience` to the API base URL without the `/public/v2` path (for example `https://public-api.drata.com`).”
help.drata.com checked 2026-10-22
“The full API key will only be shown once when you create the key.”
developers.drata.com checked 2026-10-22
“This guide walks you through setting up OAuth authentication for MCP clients.”

Graded C: the OAuth path issues tokens that expire (the documented example returns expires_in 86400), but every token is bootstrapped from a client secret Drata generates and you store, and the API spec documents only the clientCredentials flow and a static bearer API key. No token exchange, private_key_jwt, OIDC trust of GitHub Actions or cloud workload tokens, or any bring-your-own-issuer option is documented, so per the brief's precedent a client_credentials secret is C at best. The MCP server uses a per-user interactive OAuth grant, which is human login rather than workload auth. Not tier-gated in the docs, though Drata pitches OAuth Applications at enterprise customers. Moves to B or A only if Drata accepts federated tokens from an external OIDC issuer.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

AWS (and AWS GovCloud) is keyless: you create DrataAutopilotRole trusting Drata's account with your tenant's external ID. GCP requires uploading a service account JSON key, and Azure requires a client secret on an App Registration you create. GitHub, Bitbucket, GitLab, Azure DevOps, Google Workspace and DigitalOcean connect through Drata's own app or OAuth grant; Okta, JumpCloud, Cloudflare and Snowflake take tokens or client secrets you create.

help.drata.com checked 2026-10-22
“Read-Only Cross-Account Access: Use an IAM role (e.g., DrataAutopilotRole with SecurityAudit) to allow Drata to perform read-only audits across your AWS resources.”
help.drata.com checked 2026-10-22
“Enter your Drata external ID into the External ID field (this is unique to your tenant, found in the AWS connection wizard in Drata).”
help.drata.com checked 2026-10-22
“Drata assumes a designated IAM role in your AWS account to perform monitoring and evidence collection.”
help.drata.com checked 2026-10-22
“In the modal, make sure JSON is selected as the Key type and then create.”
help.drata.com checked 2026-10-22
“In Drata, upload the JSON key generated by the script (drata-key-file.json).”
developers.drata.com checked 2026-10-22
“The GCP service account key, as the raw JSON contents of the key file downloaded from GCP IAM (stringified).”
help.drata.com checked 2026-10-22
“Within the Drata Entra App created in Step 1, navigate to “Certificates & secrets” and select “New client secret””
help.drata.com checked 2026-10-22
“Note: The integration gets disconnected when the secret expires, so we recommend setting a reminder to ensure it stays active.”
developers.drata.com checked 2026-10-22
“Create a new Azure Connection using an Azure App Registration (Service Principal) and its client secret.”
help.drata.com checked 2026-10-22
“Must have permission to install GitHub Apps on your organization’s GitHub account.”
help.drata.com checked 2026-10-22
“OAuth is the primary way to connect GitLab to Drata.”
help.drata.com checked 2026-10-22
“Important: Treat the API token like a password.”
help.drata.com checked 2026-10-22
“Paste your API key when prompted.”
help.drata.com checked 2026-10-22
“Ability to create a Custom API Token with read-only scopes.”
help.drata.com checked 2026-10-22
“Expected outcome: You have the Account Identifier, Client ID, Client Secret, and Warehouse needed to connect Snowflake to Drata.”

Checked: AWS, AWS GovCloud, GCP (manual and script setup), Azure, GitHub, GitHub Enterprise Server, GitLab, Bitbucket, Azure DevOps, Google Workspace, Okta, JumpCloud, DigitalOcean, Cloudflare and Snowflake help articles, plus the v2 API's aws-, azure- and gcp-connections endpoints. AWS is keyless (cross-account role with a per-tenant external ID and the SecurityAudit policy). GCP is a static service account JSON key, held by Drata and also needing domain-wide delegation into Google Workspace; Azure is a customer-managed client secret on a single-tenant App Registration (the guide suggests a 24-month expiry and warns expiry disconnects the integration). Neither offers workload identity federation, service account impersonation or a federated credential, which is why this is B rather than A. Both come with read-only least-privilege role guidance (Reader, SecurityAudit, a reduced-permission GCP custom role). Okta takes an admin API token plus an OIN app client secret, JumpCloud and Cloudflare take API keys or tokens, Snowflake an OAuth client secret, DigitalOcean Spaces optional static access keys and GitLab an optional PAT. GitHub, Bitbucket and GitHub Enterprise Server use a Drata app you install; GitLab, Azure DevOps, Google Workspace and DigitalOcean use an interactive OAuth grant. Moves to A if GCP and Azure gain keyless options (WIF or SA impersonation; a federated credential on a Drata multi-tenant app).

Hygiene for any static credential the product still issues

✗ Expiry enforceable	API keys default to 12 months and OAuth Applications offer Never or Custom, but Never is allowed for both and no org policy to forbid it is documented. A changeable default is not an enforced expiry (precedent from this cohort's brief), so this fails. help.drata.com checked 2026-10-22 “The following options are 12 months, Never, or Custom. The default is 12 months.” help.drata.com checked 2026-10-22 “Custom (recommended for most customers)”
✗ Rotation via API	Keys and OAuth Applications are created and revoked in Settings in the web app. The v2 OpenAPI spec (159 paths) has no endpoint for API keys, OAuth Applications or client secret rotation, so rotation cannot be automated without a browser. developers.drata.com checked 2026-10-22 “Please visit our help article to learn how to create an API key.” help.drata.com checked 2026-10-22 “Select the Create API Key button.”
✓ Scoped keys	Both API keys and OAuth Applications are tenant-level integration credentials with per-resource read/create/update/delete scopes, not a copy of the creator's access. Keys can also be pinned to allowed source IPs. The "All read" and "All read and write" presets auto-grow to future scopes. help.drata.com checked 2026-10-22 “Custom: Select the specific scopes you want enabled for that API key.” help.drata.com checked 2026-10-22 “Best practice: Always follow least privilege — only enable the minimum scopes needed for your integration.”
✓ Last-used visible	Shown for API keys. A last-used field for OAuth Applications is not documented. help.drata.com checked 2026-10-22 “You can view the API key name, the status of the key, who created the API key, when the key was last used to make a request, and when the key expires.”
✗ Leak revocation	Drata does not appear in GitHub's supported secret-scanning patterns table, so neither API keys nor OAuth client secrets leaked to a public repo are reported to Drata. docs.github.com checked 2026-10-22

Notes

One card for the Drata GRC platform. SafeBase (Drata's trust-center product) has its own Trust API not graded here; Custom Connections push data in over the same Public API and credentials. Two of five hygiene checks pass (scoping, last used). An enforceable maximum expiry, key and OAuth Application management in the API, and GitHub secret-scanning partnership would fix hygiene; inbound needs real federation to pass C, and outbound needs keyless GCP and Azure to reach A.

Badge

[![wif.tax grade](https://wif.tax/badge/drata.svg)](https://wif.tax/p/drata/)