Skip to main content

Authentication

Every request carries your key in the Tessera-Api-Key header.

curl -H 'Tessera-Api-Key: tess_sk_...' \
  https://public-api-staging.yourtessera.com/v1/events

Scope​

A key is scoped to exactly one organization and grants read access to everything that organization can read. There are no per-key scopes or per-event permissions.

This means a key is more permissive than any individual collaborator, which is why only organization admins can create one. Treat it as you would a password.

Failures​

Missing, unrecognised, and revoked keys all return the same 401 with the same body:

{
  "error": "invalid_api_key",
  "message": "Provide a valid API key in the Tessera-Api-Key header. The key may be missing, unrecognised, or revoked.",
  "statusCode": 401
}

The response is deliberately identical in all three cases, so it cannot be used to work out whether a given key ever existed.

A key that fails its checksum is the one case reported separately, because it tells you something you can act on: the key was damaged, not rejected.

{
  "error": "malformed_api_key",
  "message": "The API key is not a well-formed Tessera key. Check it was copied in full.",
  "statusCode": 401
}

Revoking​

Revoke from Integrations in the dashboard. It takes effect on the very next request and cannot be undone, so anything still using that key stops working immediately.