Authentication

The TEASE API authenticates with an API key you mint in the dashboard. Send it as a Bearer token on every request.

Token format

A token looks like:

al_live_<prefix>_<secret>

Send the full token as a Bearer header on every request. It is displayed once, at creation, and never again.

Mint a key

In the dashboard, open Settings → API keys → Create key, give it a name, and choose a scope. Tick «Ограничить ключ» to hand the key the same tab/function grid a teammate gets — that is how you mint a stats-only key. You can also mint a key from the API:

curl -X POST https://app.tease.link/api/admin/api-keys \
  -H "Authorization: Bearer $TEASE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "production", "scopes": ["read", "write"] }'

const res = await fetch('https://app.tease.link/api/admin/api-keys', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.TEASE_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ name: 'production', scopes: ['read', 'write'] }),
});
const key = await res.json(); // key.token is shown ONCE

import os, requests

res = requests.post(
    "https://app.tease.link/api/admin/api-keys",
    headers={"Authorization": f"Bearer {os.environ['TEASE_API_KEY']}"},
    json={"name": "production", "scopes": ["read", "write"]},
)
key = res.json()  # key["token"] is shown ONCE

The response includes the full token exactly once:

{
  "id": 12,
  "name": "production",
  "prefix": "a1b2c3d4",
  "token": "al_live_a1b2c3d4_…",
  "scopes": ["read", "write"],
  "created_at": 1751280000
}

Scopes

A key minted without an explicit scope defaults to ["read", "write"]. Mint read-only keys for dashboards, reporting, or anything that should never mutate state.

Limit a key to part of the product

Scopes describe the method (may it write?), not the subject. To limit what a key can touch, pass the same tab/function dictionary a teammate grant uses:

{
  "name": "stats-only",
  "scopes": ["read"],
  "tabs": ["dashboard"],
  "caps": { "dashboard": ["traffic_view"] }
}

• Omit both fields and the key is unrestricted — it does whatever the person who minted it can do. Every key minted before this feature behaves exactly as before.
• tabs alone means "these tabs, all their functions"; caps alone keeps the tabs and narrows the functions.
• The limit is an intersection, evaluated per request: a key minted by a teammate can never exceed that teammate's own rights, and the moment their rights shrink, the key shrinks with them — no manual revoke.
• A key name outside the dictionary is a 422 that names it; nothing is dropped silently.

Use the token

Send it as a Bearer header on every request:

curl https://app.tease.link/api/admin/smart-links \
  -H "Authorization: Bearer al_live_a1b2c3d4_…"

Rotate & revoke

Revoking a key is immediate and irreversible — any request using it afterwards is rejected.

curl -X DELETE https://app.tease.link/api/admin/api-keys/12 \
  -H "Authorization: Bearer $TEASE_API_KEY"

To rotate, mint a new key, deploy it, then revoke the old one. The keys list never returns the secret — only the prefix, name, scopes, and last-used time.