Authentication

One API key per project, sent on every request:

x-api-key: tp_test_...

Authorization: Bearer tp_test_... is accepted too. The hosted pages (static, without headers) may pass the key as ?key=; never do that from a server, a URL ends up in logs.

Keys

A key is tp_test_... or tp_live_.... The platform never stores a key: only its fingerprint, so a lost key cannot be recovered, only replaced.
A key opens one project, never more. Another project's resources answer 404, as if they did not exist.
A revoked key answers 401 API_KEY_REVOKED from the very next request.

Modes: test and live

Key	Works on	Reaches
`tp_test_...`	any project	the sandbox, never a real provider
`tp_live_...`	a project in live mode only	real providers

A project in test mode only takes test keys. A live key used on a test project answers 401 API_KEY_INVALID.

Scopes

A key carries scopes: what it may do. A call without the right scope answers 403 SCOPE_MISSING, and the message names the scope. The reference shows the scope each route needs.

Scope	Allows
`projects:read`	read the project of the key
`webhooks:read`	list webhook endpoints
`webhooks:write`	register, delete and rotate endpoints, send a test event, replay an event
`usage:read`	read usage and daily limits
`subjects:erase`	erase a person across the capabilities of the project

Give a key the scopes it needs and no more: a key that only reads usage should not be able to replay events.

Rate limiting

Each key has its own budget of requests per minute: a key that runs away does not slow the others. See Limits.