Skip to main content

Authentication

Every call to /v1/* is authenticated with an API key in the Authorization header:

Authorization: Bearer tsk_1a2b3c4d_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Format and lifecycle​

  • The key has the format tsk_<prefix>_<secret>. The prefix (8 hexadecimal characters) identifies the key in the panel; the secret is never stored in plain text, only its SHA-256 hash.
  • The key is shown only once, when it is created. If you lose it, revoke it and create another one.
  • Each key belongs to one customer (tenant). With it you only see the questions and answers of your own tenant.
  • Revocation (panel, Credentials screen) takes effect immediately: the key starts answering 401 invalid_api_key.
  • Each tenant can have up to 20 active keys. Use one per system or environment (production, staging) so you can revoke one without breaking the others.

Where to keep it​

Never use the key in the browser or in the app

The API key is a secret of your server. Do not put the key in frontend code, mobile apps, repositories or logs. The user's browser must talk to your backend, and your backend talks to Datafala.

Keep the key as an environment variable or in a secrets vault:

# Dokku
dokku config:set meu-app DATAFALA_API_KEY=tsk_1a2b3c4d_...

# Heroku / Render / Railway: use the service's environment variables panel

Authentication errors​

HTTPcodeWhen
401invalid_api_keyHeader missing, malformed, key does not exist or was revoked

Do not repeat the request without fixing the key. The /v1 endpoints ignore cookies, and the panel (/admin) ignores API keys.