Authentication

Secret keys

Most API endpoints require a secret key. Pass it as a Bearer token in the Authorization header.

Authorization: Bearer tn_live_xxxxxxxxxxxxxxxxxxxx

Secret keys are prefixed with tn_live_. Get yours from the dashboard.

Secret keys have full access to your account. Never expose them in client-side code, browser requests, or public repositories.

The device endpoints (/identify and /validate) use a publishable key instead. Publishable keys are safe to embed in browser JavaScript.

POST /identify
Content-Type: application/json

{
  "publishable_key": "pk_live_xxxxxxxxxxxxxxxxxxxx",
  "components": { ... }
}

Publishable keys are prefixed with pk_live_. Find yours in the dashboard under API Keys.

Status	Meaning
`401`	Missing or invalid API key
`403`	Valid key, but quota exhausted. Subscribe or buy top-up credits