Authentication
Every request to the API carries an API key. Requests are never matched to a browser session.
Creating a key
Create keys under API keys in your account, up to 5. A key is shown once, when it is made: we store only a hash of it, so nobody can show it to you again. We email you when a key is made on your account.
Sending a key
Send it in the Authorization header as Bearer followed by the key. X-API-Key works too.
curl "https://api.talismanleads.io/v1/account" \
-H "Authorization: Bearer tl_live_your_key_here"What a key can do
A key is either read only or able to place orders. A read-only key can see your balance, the checkers, your orders and their results. Only a key that can place orders can use POST /uploads, POST /estimates and POST /orders, as those store your list or spend your balance.
Limiting a key
A key can expire after 30 days, 90 days or a year, and can be held to the IP addresses of your server. A request from any other address is refused with ip_not_allowed.
Keeping a key safe
- Treat a key like a password: anyone holding it can spend your balance.
- Use it only on your server. The API does not allow calls from a web page.
- Keep it out of your code and your version control.
- If a key may have been seen, revoke it in your account at once. It stops working straight away. Orders already placed keep running.
- Send it only to the API. Upload and download links carry their own permission, so do not send your key to them.
When a key is refused
A key that is wrong, revoked or past its date answers 401. A key or an account that has been blocked answers 403. See Errors.