Getting Started

Authentication

How API keys authenticate requests.

Every request needs an API key in the Authorization header. Keys look like tk_<12-character id>_<secret>. The id part is shown in your dashboard; the secret is shown only once and Taken stores only a SHA-256 hash of it.

Authorization: Bearer tk_XXXXXXXXXXXX_your-secret

• Use HTTPS only. Never put keys in URLs, front-end code or shared repositories.
• Each request is checked for a valid, unrevoked, unexpired key, the endpoint's permission, your ownership of the resource, your subscription, and rate limits.
• Every response includes an x-request-id header. Include it when contacting support.