Authentication
Organisation API keys — how to send one, and where one must never go.
Requests carry an organisation API key as a bearer token:
Authorization: Bearer tbk_<plaintext-key>Keys are created under Organisation → API keys. Only a SHA-256 fingerprint is stored, so the plaintext is shown once at creation and cannot be retrieved afterwards. If you lose it, revoke it and create another.
If a key stops working
A key can start being refused without anyone having edited it. Check the abilities it carries under Organisation → API keys; if those look right, the next thing to check is your organisation's access to that endpoint — see Activation and Errors.
Abilities are fixed at issue time
A key cannot gain an ability after it is created, so widening scope means issuing a new key rather than editing an existing one.
Using a key in the playground
The Try it panel on every reference page sends a real request to the live API with whatever key you paste in. Use a key scoped to reads while you are exploring. A key that can delete firewall rules will delete them.
Never paste a key into a page you did not navigate to yourself, and never commit
one. A tbk_ key is a credential for your whole organisation's API surface, not a
per-user token.
It is also not safe in a browser. Anything shipped to the client — a dashboard, a status widget — puts the key in the hands of anyone who opens devtools. Call the API from your own backend and proxy the result.