Get started
Authentication
All API requests authenticate with a Bearer API key:
Authorization: Bearer tt_liv...xxxx
Keys are created and managed in the dashboard under DEVELOPERS → API Keys (sidebar, bottom left). There is no OAuth flow for the v1 API — keys are the only credential.
Key types
| Type | Prefix | Behavior |
|---|---|---|
| Live | tt_live_ | Dispatches real agents, streams to real platforms, consumes plan minutes. |
| Test | tt_test_ | Full request/response lifecycle with simulated status transitions. No agent dispatch, no minutes consumed. Use it to build your integration. |
Test and live keys use the same endpoints and response shapes, so swapping
tt_test_ for tt_live_ is your entire go-live step. A test key only sees and
ends streams started with a test key: your real streams are left out of its
lists and analytics, and reading or ending one returns 404 not_found.
Scopes
Keys carry least-privilege scopes, chosen at creation:
| Scope | Grants |
|---|---|
streams:read | GET /streams, GET /streams/{id} |
streams:write | POST /streams, DELETE /streams/{id} |
analytics:read | GET /analytics |
webhooks:write | POST/GET/DELETE /webhooks |
A request with an insufficient scope returns 403 { "error": { "code": "insufficient_scope" } }.
How we store keys
- Keys are generated as
tt_<env>_+ 24 cryptographically random characters. - We store only a SHA-256 hash + the last 4 characters. The full key is displayed once at creation and cannot be retrieved again.
Last usedin the dashboard updates periodically (throttled to avoid write pressure).
Rotation & revocation
- Revoke a key any time from the dashboard — it stops working immediately.
- Keys can have an expiry date set at creation. Expired keys are treated as revoked.
- To roll a key without downtime: create a new key, deploy it, confirm
traffic has moved (watch
Last usedon the old key), then revoke the old one.
Security rules
- Server-side only. Never ship a key in a browser bundle, mobile app, or client-side code. Anyone holding a live key can start billable streams.
- One key per service. If a key leaks, you know exactly which system to fix.
- Store keys in a secrets manager (1Password, Doppler, Vercel env vars) — never in git.
- If you believe a key has leaked, revoke it first, investigate second.
Was this page helpful?