Skip to main content

Manage API Keys

Manage Talonic API keys programmatically: list masked keys, mint a new scoped key (the raw secret is returned once), and revoke keys you no longer need.

The API key management endpoints let a workspace manage its own Talonic API keys programmatically: list your keys (always masked, the raw secret is never returned again), mint a new key with a name and a chosen scope set, and revoke a key you no longer need. The raw secret of a new key is returned exactly once, on creation; store it immediately.

A key carries a subset of the valid scopes: extract, read, write, operations, billing, delivery. If you omit scopes on create, the key defaults to extract, read, write, operations. Revocation is scoped to your own workspace; revoking a key that belongs to another organization is impossible and returns 404.

GET/v1/account/keys
POST/v1/account/keys

Body parameters

name*stringA label for the key (max 255 characters), e.g. "ci-pipeline".
scopesstring[]Requested scopes (subset of extract, read, write, operations, billing, delivery). Defaults to extract, read, write, operations.

curl — mint a key scoped to extraction and reads

curl -X POST https://api.talonic.com/v1/account/keys \
  -H "Authorization: Bearer $TALONIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "ci-pipeline", "scopes": ["extract", "read"] }'

Response (201 Created)

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "ci-pipeline",
  "key": "tlnc_0123456789abcdef0123456789abcdef",
  "masked_prefix": "tlnc_a1b2c3...",
  "scopes": ["extract", "read"],
  "created_at": "2026-07-01T10:00:00.000Z",
  "warning": "Store this key now. It will not be shown again."
}
DELETE/v1/account/keys/:keyId

Path parameters

keyId*stringThe API key id to revoke.
The raw key secret is shown only once, in the create response. If you lose it, revoke the key and mint a new one — it cannot be retrieved again.

Frequently asked questions

Can I retrieve an API key secret later?+
No. The raw secret is returned only once, in the create response. Listing keys returns masked values. If lost, revoke the key and mint a new one.
What scopes can a Talonic API key have?+
A subset of extract, read, write, operations, billing, and delivery. Omitting scopes on create defaults to extract, read, write, operations.
How do I rotate a Talonic API key?+
Mint a replacement with POST /v1/account/keys, deploy the new secret to your integration, then revoke the old key with DELETE /v1/account/keys/:keyId. Revocation takes effect immediately.

Related

Account Snapshot
Authentication and Scopes