Authentication
This page explains how to authenticate when sending events to Tidings. Ingestion authenticates with a per-project API key sent in the X-API-Key header. Keys are scoped to one project: events land in the project the key belongs to, and nowhere else.
API keys
Find and create keys under Settings → API keys in the app. Every new project starts with a default key. Keys are prefixed td_ — read them from configuration or environment, and never commit them.
How keys behave
- Create as many keys as you like — one per environment (production, staging) keeps data clean.
- Revoking a key stops its events immediately without touching data it already sent.
- Requests with a missing, unknown, or revoked key get
401.
The X-API-Key scheme is only for sending events. Reading data back out uses a different, user-scoped credential — there are three schemes in all:
| Header | Credential | Used for |
|---|---|---|
| X-API-Key: td_… | Per-project API key | Sending events, and nothing else. Safe in public HTML. |
| Authorization: Token … | Your login token | The app's own session — everything you can see in the UI. |
| Authorization: Bearer tk_… | Personal access token | Scripts, CI, and AI agents. Scoped read or read_write, revocable on its own. |
See Querying events for the read API, and Connect AI agents for handing an agent a token of its own.