Skip to main content
Tidy Names

API Keys

API keys let you access your organisation's data programmatically. Use them to integrate Tidy Names with your own tools, dashboards, or automation workflows.

API keys are available on the Studio plan and above. Read-write access is available on the Enterprise plan.

Creating an API Key

  1. Go to Settings → API Keys
  2. Click Create Key
  3. Enter a descriptive name for the key (e.g. "Monitoring dashboard" or "Monthly report script")
  4. Select a scope:
    • Read - retrieve data only
    • Read-write - retrieve and modify data (Enterprise plan only)
  5. Optionally set an expiry date
  6. Click Create

The full API key is displayed only once. Copy it immediately and store it in a secure location such as a password manager or secrets vault.

Using Your API Key

Include the key in the Authorization header of your requests:

Authorization: Bearer tn_your_key_here

Two API endpoints are currently available:

EndpointDescription
Activity logsRetrieve your organisation's activity history
Login historyRetrieve sign-in records for your organisation

Managing API Keys

Viewing your keys

Go to Settings → API Keys to see all active keys for your organisation. Each entry shows the key name, scope, creation date, expiry date (if set), and when it was last used.

Revoking a key

  1. Go to Settings → API Keys
  2. Click the revoke button next to the key you want to disable
  3. Confirm the revocation

Revoked keys stop working immediately. Any integrations using the key will no longer be able to authenticate.

Rotating a key

To rotate a key, create a new key first, update your integrations to use the new key, then revoke the old one. This avoids any downtime in your integrations.

Limits

Each organisation can have a maximum of 10 API keys at any time. If you need to create a new key and have reached the limit, revoke an unused key first.

Security Best Practices

  • Use read-only scope unless your integration needs to modify data
  • Set an expiry date for keys used in temporary or short-lived integrations
  • Never commit API keys to version control - use environment variables or a secrets manager
  • Rotate keys periodically, especially if a team member with access to the key leaves your organisation
  • Monitor the last used date to identify stale keys that can be revoked

Next Steps