Authentication
One key per partner, sent to you at signing; how to send it and what to do if it leaks.
Every request to the Partner API carries your API key in the x-api-key header. The key is scoped to your organization: it reaches your own customers and nothing else. There are no user logins, sessions or OAuth flows on the API.
How you get the key
Telgea creates your key when your contract is signed and sends it to you through a secure one-time link. Open the link once and put the key straight into your secret manager: the link stops working after that, and nobody at Telgea sees the key.
Sending it
curl https://api.telgea.com/v1/users \
-H "x-api-key: $TELGEA_API_KEY"A missing or invalid key returns 401. A valid key without the permission an operation needs returns 403, naming the missing permission; every operation in the API reference lists the permission it needs.
To check the key before writing any code, paste it into the playground and send a read such as List users.
If it leaks
Contact Telgea support. We disable the key and send you a new one the same way.
Keeping it safe
- Store the key in a secret manager and read it into your server at runtime.
- Never ship it in a browser, a mobile app, or a repository.
- The key identifies your organization to Telgea; your own customers must never see it.
Related
- Users: the first call most integrations make.