API Keys
Create, list, update, and revoke API keys for programmatic access to Talkturo — manage scopes, expiration, and key lifecycle through REST endpoints.
curl -X GET "https://api.talkturo.com/api/api-keys?accountSlug=acme-sales" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example" \
-H "Accept: application/json"
{
"apiKeys": [
{
"id": "9d12c4d8-4cbf-4a20-b8a2-4a3fe1d94b55",
"name": "Production CRM sync",
"description": "Sync contacts from the CRM integration service",
"key_prefix": "tk_live_a1b2c3d4",
"permissions": {
"scopes": ["*"],
"rate_limit_per_hour": 1000
},
"last_used_at": "2026-02-18T14:22:11.382Z",
"expires_at": "2026-08-01T00:00:00.000Z",
"is_active": true,
"created_at": "2026-01-15T09:41:03.120Z",
"created_by": "5b4b8a0e-ec8d-4f5d-85c9-d04e31ef7f4b"
},
{
"id": "cf0a39b7-fb48-4f72-a343-0fd628bc7b01",
"name": "Staging webhook worker",
"description": "Used by the staging event processor",
"key_prefix": "tk_test_7f8e9d0c",
"permissions": {
"scopes": ["assistants:read"],
"rate_limit_per_hour": 500
},
"last_used_at": null,
"expires_at": null,
"is_active": true,
"created_at": "2026-01-12T16:10:44.901Z",
"created_by": "5b4b8a0e-ec8d-4f5d-85c9-d04e31ef7f4b"
}
]
}
curl -X POST "https://api.talkturo.com/api/api-keys" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-d '{
"accountSlug": "acme-sales",
"name": "Outbound automation",
"description": "Used by the outbound workflow runner",
"environment": "live",
"expiresInDays": 90,
"permissions": {
"scopes": ["*"],
"rate_limit_per_hour": 1000
}
}'
{
"apiKey": {
"id": "de334d7b-bdc1-452e-93ae-2f765db452b0",
"name": "Outbound automation",
"description": "Used by the outbound workflow runner",
"key_prefix": "tk_live_3fa4c9d1",
"permissions": {
"scopes": ["*"],
"rate_limit_per_hour": 1000
},
"last_used_at": null,
"expires_at": "2026-05-19T10:15:00.000Z",
"is_active": true,
"created_at": "2026-02-18T10:15:00.000Z",
"created_by": "5b4b8a0e-ec8d-4f5d-85c9-d04e31ef7f4b",
"fullKey": "tk_live_3fa4c9d1QvQhJ5rD2N8wYbP6mTzK1sF4xL9cA7uE0nR3yH6jM2"
}
}
curl -X PATCH "https://api.talkturo.com/api/api-keys/9d12c4d8-4cbf-4a20-b8a2-4a3fe1d94b55" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-d '{
"name": "Production CRM sync v2",
"description": "Updated integration worker",
"isActive": false
}'
{
"apiKey": {
"id": "9d12c4d8-4cbf-4a20-b8a2-4a3fe1d94b55",
"name": "Production CRM sync v2",
"description": "Updated integration worker",
"key_prefix": "tk_live_a1b2c3d4",
"permissions": {
"scopes": ["*"],
"rate_limit_per_hour": 1000
},
"last_used_at": "2026-02-18T14:22:11.382Z",
"expires_at": "2026-08-01T00:00:00.000Z",
"is_active": false,
"created_at": "2026-01-15T09:41:03.120Z",
"created_by": "5b4b8a0e-ec8d-4f5d-85c9-d04e31ef7f4b"
}
}
curl -X DELETE "https://api.talkturo.com/api/api-keys/9d12c4d8-4cbf-4a20-b8a2-4a3fe1d94b55" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example" \
-H "Accept: application/json"
{
"success": true,
"message": "API key revoked successfully"
}
API key management
Manage API keys for a Talkturo account with REST endpoints that list keys, create new keys, update metadata, and revoke access. These endpoints return key metadata for existing keys and return the plaintext fullKey only when you create a new key.
Authenticate every request with a Bearer JWT and use an account member with the owner or admin role. These endpoints do not accept API key authentication.
API key object
The API returns the same metadata fields across list, create, and update operations.
Unique API key ID.
Display name for the key.
Optional description for the key.
Non-secret prefix used to identify the key in the dashboard and API responses.
Permission settings for the key, including scopes and rate limit configuration.
Timestamp of the most recent successful use, or null if the key has never been used.
Expiration timestamp, or null if the key does not expire.
Whether the key can still authenticate requests.
Timestamp when the key was created.
User ID of the account member who created the key.
Key format and lifecycle
New keys use the format tk_{environment}_{random} where environment is live or test. Talkturo stores a SHA-256 hash of the key and does not store the plaintext value.
Copy and store fullKey when you create a key. Talkturo returns the plaintext key exactly once and cannot show it again later.
List API keys
Get all API keys for an account. The response includes metadata only and never includes plaintext keys.
Query parameters
Account slug that owns the API keys to list.
Response fields
Array of API key objects for the specified account.
Create API key
Create a new API key for an account. The response includes the standard key metadata plus fullKey.
Body parameters
Account slug that will own the new key.
Display name for the key.
Optional description that helps you identify the key later.
Number of days until the key expires. Omit this field to create a key without an expiration date.
Permission object for the new key. Defaults to scopes: ["*"] and rate_limit_per_hour: 1000.
Allowed scopes for the key. The default value is ["*"].
Maximum number of requests the key can make per hour. The default value is 1000.
Response fields
Created API key object.
Plaintext API key. Talkturo returns this field once at creation time and never returns it again.
Update API key
Update mutable fields on an existing API key. This endpoint changes display metadata or active status and does not rotate the key value.
Path parameters
UUID of the API key to update.
Body parameters
New display name for the key.
New description for the key.
Set to false to disable the key or true to re-enable it.
Response fields
Updated API key object.
Revoke API key
Delete an API key and immediately revoke its access. Use this endpoint when a key is no longer needed or you suspect it has been exposed.
Path parameters
UUID of the API key to revoke.
Response fields
Whether the revoke operation completed successfully.
Human-readable status message for the revoke operation.
Notes on permissions
Permissions are stored as an object on each key. A typical payload includes scopes and rate_limit_per_hour.
List of scopes assigned to the key.
Hourly request limit assigned to the key.
Keys can use wildcard scopes such as *, prefix wildcards such as assistants:*, or exact scope strings. Choose the narrowest scopes that match your integration.