Automated drift tracking with an API key

The manual baseline workflow works for occasional checks, but drift is continuous and deserves a continuous instrument. Generate an API key in the Dembrandt App under API keys, then pass it to the CLI with --key. Each run uploads the extraction to your account under the site's domain and scores it against the last stored snapshot. There is nothing to save or drag: the history lives in the cloud, grouped by domain, with a timeline you can scrub and a drift report between any two points. Wire the same command into CI so every deploy records a snapshot, and the brand gets a commit log. When a color shifts, you see which release introduced it. Keys are secret and shown once, so store them as a CI secret and never in the repo. Per-account extraction limits apply: 20 per hour, 200 per day, 500 per week.

Push a snapshot to your account

Terminal

dembrandt app.example.com --key dmb_xxx

Push from a container or CI runner

Terminal

dembrandt app.example.com --key dmb_xxx --no-sandbox

GitHub Actions: snapshot after every production deploy

# .github/workflows/drift.yml

# Store key as repo secret: DEMBRANDT_KEY

name: Cloud drift snapshot

on:

deployment_status:

jobs:

snapshot:

if: >

github.event.deployment_status.state == 'success' &&

github.event.deployment_status.environment == 'Production'

runs-on: ubuntu-latest

steps:

- uses: actions/setup-node@v4

with:

node-version: 24

# Cache the browser so it is downloaded once, not every run

- name: Cache Playwright Chromium

uses: actions/cache@v4

with:

path: ~/.cache/ms-playwright

key: playwright-chromium-${{ runner.os }}

- name: Install Chromium

run: npx playwright-core install --with-deps chromium

- name: Snapshot

env:

DEMBRANDT_KEY: ${{ secrets.DEMBRANDT_KEY }}

# Snapshots group by hostname. Only use the event URL when production

# always resolves to one canonical host; otherwise hardcode it.

TARGET_URL: ${{ github.event.deployment_status.target_url }}

# Over quota (20/hr, 200/day, 500/wk) the upload is skipped with a

# warning and the step still exits 0 — it never fails the pipeline.

run: |

npx -y dembrandt@latest "$TARGET_URL" --key "$DEMBRANDT_KEY" --no-sandbox

Where the history lives

# dembrandt.com/app/extractions

# Cloud column, open the domain, scrub the timeline.

# The drift panel shows what changed between snapshots.