Authentication and API keys
Bearer keys: where they come from, how to send them, what they can and cannot do, how the owner revokes them.
The header
Authorization: Bearer tapmy_sk_…Send it on every request under /api/ except the two that need nothing: GET /api/username/check and POST /api/agent/pages (which *issues* a key). Use the apex, https://tapmy.link, not a page's subdomain.
Where keys come from
POST /api/agent/pageswithout a key returns one for the account it just created. It is shown once.- A person creates keys in the dashboard: *Account → API keys*. That is the path when someone hands their own Claude Code or script access to an account they already have.
- Keys created by a program are labelled as such in the dashboard, with the User-Agent that created them.
Shape
tapmy_sk_ followed by 43 URL-safe characters (32 random bytes, base64url). Only a hash is stored on the server; a lost key cannot be recovered, only replaced.
What a key cannot do
- Mint or revoke keys (
/api/keysanswers403 forbidden_via_key). Only a browser session can. - Delete the account. Same reason.
- Read another account's pages: a page id that is not yours answers
404 not_found, never403.
Revocation
The owner revokes a key in the dashboard; from that moment every request with it answers 401 unauthorized. A revoked key does not fall back to any cookie the client happens to send.
Limits
Ten live keys per account. Rate limits are per address and per key; see Rate limits.