Skip to main content

Authentication for End Users

The Public API authenticates requests using an API key passed in the request header.

Generating an API Key​

  1. Log in to the Tidely application
  2. Navigate to Settings → API Keys
  3. Click the + icon to create a new key
  4. Copy and store the key securely

For staging: https://app.sam.tidely.com/settings/openapi

Using and verifying Your API Key​

Include the API key in every request using the X-Authorization header.

To confirm the API key is valid, you may use the verify endpoint:

curl -X GET https://api.tidely.com/public/v2/authentication/verify-auth \
  -H "X-Authorization: tk_live_xxxxxxxxxxxxxxxxxxxx"

Successful response:

{
  "success": true,
  "name": "Your API key name"
}

Security Best Practices​

  • Never expose your API key in client-side code, version control, or logs
  • Rotate keys regularly — generate a new key and invalidate the old one periodically
  • Use environment variables to inject the key at runtime rather than hardcoding it
  • Use one key per integration — this makes it easy to revoke access for a specific integration without affecting others

Revoking a Key​

In the Tidely application, navigate to Settings → API Keys and select Delete from the menu next to the key you want to revoke. The key is invalidated immediately.