Authentication

Every request to the REST API is authenticated with a personal Secret Key, sent as a Bearer token. This page explains how to find, use, rotate, and protect that key.

Open Webhooks & API — from the top navbar or your account dropdown — then the API Key tab on the left.

Your Secret Key

Your account has exactly one Secret Key — not one per workspace, and not one per site. You don't generate it manually; it's created automatically the first time you open the API Key tab, and it carries the full access of every workspace you belong to.

Copying your key

Regenerating (rotating) your key

If a key is exposed or you simply want to rotate it:

Key metadata & usage

Below the key field you can audit its activity:

• Prefix — the leading characters, so you can identify the key without revealing it.
• Generated — when the current key was created.
• Last used — the timestamp and source IP of the most recent authenticated request (e.g. from 192.168.1.1). This line doesn't appear at all until the key has been used at least once.

Authenticating Requests

Send the key in the Authorization header as a Bearer token on every request:

Authorization: Bearer tdc_YOUR_API_KEY

Examples

# cURL
curl -H "Authorization: Bearer tdc_YOUR_API_KEY" \
  https://yourapp.com/api/v1/me

// Node.js (fetch)
const res = await fetch('https://yourapp.com/api/v1/me', {
  headers: { Authorization: 'Bearer tdc_YOUR_API_KEY' },
});
const result = await res.json();
if (result.ok) {
  const { data } = result;
  console.log('User profile:', data);
} else {
  console.error('Error:', result.error, result.message);
}

A missing or invalid key returns 401 UNAUTHORIZED. See error handling.

Security Best Practices

• Never expose it client-side. Keep it out of browser code, mobile apps, and any public repository.
• Server-side only. Store it in server environment variables, not in source control.
• Rotate on exposure. If a key may have leaked, Regenerate key immediately.
• There's no way to scope a key per environment. Since there's only one key per account, you can't issue a separate "test" key — a leaked or misused key affects every workspace you're in, production included. If you need to test integrations safely, point them at a non-production webhook endpoint rather than trying to isolate by key.
• Mind the rate limit. Requests are capped at 1,000/hour per key-and-IP pair — see Rate Limits.

Next Steps