Authentication

API keys (private beta)

A Talki customer creates a key in the dashboard and pastes it into your integration. Send it as a bearer token:

Authorization: Bearer talki_live_…

Properties worth knowing:

• Talki stores a hash. The secret is displayed once, at creation.
• Each key carries a display name, a public prefix hint, scopes, an owner, a creation time, an optional expiry, a last-used time, and a revocation time.
• Revocation takes effect immediately.

Storage guidance

Treat the key like a database password: server-side only, encrypted at rest, never in a browser, a mobile binary, or a URL. A key grants access to one Talki account’s customer data.

OAuth (planned)

Multi-account integrations will move to an OAuth authorization-code flow with PKCE over the same authorization core. It is not available yet. Build against keys; the migration will be additive.

Scopes

Requests carry only the scopes the customer granted. A call outside them fails with insufficient_scope — distinct from plan_upgrade_required, which means the credential is fine but the account’s plan is not.