Developers
Authentication and keys
A key belongs to one organisation and holds a set of scopes. Send it as a bearer token.
bash
Authorization: Bearer tkm_live_9f2c…Keys are minted in the dashboard by an owner or admin, and shown once. The prefix tells you the environment: tkm_live_ or tkm_test_. Test keys behave the same but are labelled so a key pasted into the wrong system is visible in a log.
Scopes
| Scope | Allows |
|---|---|
| organisation.read | Read your organisation's details |
| templates.read | List and read templates and versions; list the starter library |
| templates.manage | Create, change, version and activate templates |
| documents.generate | Generate documents (includes documents.read) |
| documents.read | Read and download documents |
| documents.manage | Delete documents |
| usage.read | Read usage figures |
| webhooks.manage | Register and manage webhook endpoints |
A manage scope implies its read scope. A key can never be given more than the person minting it holds. Revoking a key takes effect on the next request.
What a key cannot do
Manage other keys, change the plan, move money, or invite people. Those need a signed-in person.
Never put a key in a URL. It ends up in access logs, browser history and screenshots. The header is the only place it is read from.