Skip to main content

Authentication

Authenticate with the Talonic API using Bearer tokens: API keys prefixed tlnc_ carry scopes like extract, read, write, and billing that gate access.

Talonic API authentication uses Bearer tokens: every request carries an API key in the Authorization header. Keys are prefixed tlnc_, are scoped per workspace, and carry a set of scopes that determine which operations they can perform. Create and manage keys from Settings → API Keys in the dashboard, or programmatically via [POST /v1/account/keys](account-keys).

Authorization header

API Key Scopes

Each API key carries one or more scopes that determine which operations it can perform. New keys default to extract, read, write, and operations.

Available scopes

extractscopeSubmit documents for extraction (`POST /v1/extract`, `POST /v1/documents/:id/re-extract`).
readscopeRead operations — list and retrieve documents, extractions, schemas, jobs, sources, and other resources.
writescopeWrite operations — create, update, and delete schemas, sources, jobs, delivery bindings, and other resources.
operationsscopeOperational actions such as triggering Jobs and Pipeline runs and managing in-flight work.
billingscopeBilling operations — trigger credit top-ups (`POST /v1/billing/topup`). Not included by default; add explicitly when creating the key.
deliveryscopeDelivery operations — manage destinations, bindings, and webhook delivery. Not included by default.

New keys default to extract, read, write, and operations. The billing and delivery scopes must be added explicitly. If a request requires a scope your key does not carry, the API returns 403 with error code insufficient_scope and lists the required scopes in the response body.

Keep your API key secret. Do not expose it in client-side code or version control. If a key is compromised, revoke it immediately from the dashboard or with DELETE /v1/account/keys/:keyId and mint a replacement.

Related

Manage API Keys
Base URL
Error Codes