Authentication
Where your API key lives, how to send it, and how to keep it safe.
Every request to the Telgea API carries your organisation's API key in the x-api-key header. There are no user logins, sessions or OAuth flows on the API.
Where the key is
Your key is managed in your Telgea Portal under Integrations → API keys, at https://<your-organisation>.telgea.com/integrations/api-keys (for example telgea.telgea.com/integrations/api-keys). Admins create keys there, and a new key is shown once at creation.
Sending it
curl https://api.telgea.com/v1/users \
-H "x-api-key: $TELGEA_API_KEY"A missing or invalid key returns 401. A valid key without the permission an operation needs returns 403, naming the missing permission; every operation in the API reference lists the permission it needs.
To check a key before writing any code, paste it into the playground and send a read such as List users.
Keeping it safe
- Store the key in a secret manager and read it into your server at runtime.
- Never ship it in a browser, a mobile app, or a repository.
- Use one key per integration so you can retire one without touching the others.
Related
- Users: the first call most integrations make.