Authentication
Send a key as a bearer token on every request. A key sees what its person sees in one workspace.
curl https://taseli.co.il/api/v1/workspace \
-H "Authorization: Bearer $TASELI_KEY"The header is the only way in. A key in the URL is ignored. The API sends no CORS headers: call it from your server, never from a web page.
Two kinds of key
| Personal key | OAuth access token | |
|---|---|---|
| For | Your own scripts, CRM, dashboards | AI apps connected through the consent screen |
| Made in | Settings › AI agents | The app's sign-in |
| Looks like | tsl_ and 48 hex characters | The same |
| Expires | When revoked | After 1 hour |
| Webhooks | Yes, if it isn't read-only | No: a webhook outlives its token |
Each person can hold up to 20 open personal keys per workspace.
What a key can do
Taseli reads the person's role on every request, so a demotion takes effect on the next call.
| Role | Reads | Webhooks |
|---|---|---|
| Owner, admin | Yes | Yes |
| Manager, analyst | Yes | No: 403 |
| Client roles, members limited to one client | No | No |
A read-only key reads; creating, deleting or testing a webhook with one answers 403 scope. Scopes: read covers every GET, propose covers changing webhooks.
Revoking
Settings › AI agents › Keys and apps. A revoked key stops on the next request, and any webhook it made is paused. A leaked key is read access to the business's ad data and spend, so revoke it at once.
Failures
No key, or a bad one, answers 401 with a WWW-Authenticate header. See Errors.