Authentication
Every API request needs an API key in the Authorization header:
Authorization: Bearer tvn_live_8Kq2...API keys
- Keys start with
tvn_live_followed by 32 random characters. - A key belongs to one project in your organisation. Usage and tasks are recorded per project and per key.
- The full key is shown once, when you create it. We store only a hash and the first 12 characters, so we can't show it again.
- Create, list and revoke keys under API keys. Revoking takes effect within a few seconds.
Keep keys safe
- Keep keys on your server. Never put them in a browser, a mobile app or a public repository.
- Use one key per service, so you can revoke one without stopping the others.
- If a key leaks, revoke it at once and create a new one. The activity log shows who created and revoked each key.
Optional headers
| Header | What it does |
|---|---|
Idempotency-Key | Send the same value when you retry a request. We return the first result instead of running it twice. Keys are kept 24 hours. |
X-Tovano-Customer | Your own ID for the end customer this call is for. Usage is grouped by it. Same as the customer field. |
Errors
A missing or wrong key returns 401:
{
"error": {
"type": "authentication_error",
"code": "invalid_api_key",
"message": "The API key is missing or not valid."
}
}Dashboard sign-in
People sign in to the dashboard with an email link, Google or GitHub. There are no passwords. Sign-in links are single-use and expire after 15 minutes.