Developer documentation
Authentication
Developer credentials belong to an organization and environment. The complete key is shown once, stored only by the customer, and can be revoked and replaced from the console.
Implementation guide
What the integration should preserve.
- 01
Send the key in the Authorization bearer header.
- 02
Never embed a permanent developer key in client-side JavaScript.
- 03
Keep sandbox and production credentials in separate secret stores.
- 04
Revoke a key immediately when its custody is uncertain.
- 05
Use the short-lived portal session only for the console—not as an application credential.
Example
Authorization: Bearer tm_sandbox_••••••••••••
Idempotency-Key: your-stable-operation-idContinue reading