# Authentication

> Send a key as a bearer token on every request. A key sees what its person sees in one workspace.

Source: https://taseli.co.il/en/developers/authentication

```bash
curl https://taseli.co.il/api/v1/workspace \
  -H "Authorization: Bearer $TASELI_KEY"
```

The header is the only way in. A key in the URL is ignored. The API sends no CORS headers: call it from your server, never from a web page.

## Two kinds of key

|  | Personal key | OAuth access token |
| --- | --- | --- |
| For | Your own scripts, CRM, dashboards | AI apps connected through the consent screen |
| Made in | Settings › AI agents | The app's sign-in |
| Looks like | `tsl_` and 48 hex characters | The same |
| Expires | When revoked | After 1 hour |
| Webhooks | Yes, if it isn't read-only | No: a webhook outlives its token |

Each person can hold up to 20 open personal keys per workspace.

## What a key can do

Taseli reads the person's role on every request, so a demotion takes effect on the next call.

| Role | Reads | Webhooks |
| --- | --- | --- |
| Owner, admin | Yes | Yes |
| Manager, analyst | Yes | No: `403` |
| Client roles, members limited to one client | No | No |

A read-only key reads; creating, deleting or testing a webhook with one answers `403 scope`. Scopes: `read` covers every GET, `propose` covers changing webhooks.

## Revoking

Settings › AI agents › Keys and apps. A revoked key stops on the next request, and any webhook it made is paused. A leaked key is read access to the business's ad data and spend, so revoke it at once.

## Failures

No key, or a bad one, answers `401` with a `WWW-Authenticate` header. See [Errors](https://taseli.co.il/en/developers/errors).