Skip to main content

​
API Keys

Local TattooAPI API key management is retired. Machine and private worker credentials are created, rotated, and revoked in the partner portal. TattooAPI validates incoming X-API-Key values, then resolves the non-secret credential identity to a TattooAPI actor mapping. This is WorkOS organization API-key M2M authentication, not OAuth client credentials. WorkOS validates the key and owns its lifecycle; TattooAPI uses the non-secret key ID to load a Convex service-actor mapping and enforce route, tenant, studio, artist, and review boundaries.

​
Retired Endpoints

  • GET /api-keys
  • POST /api-keys
  • GET /api-keys/{id}
  • PUT /api-keys/{id}
  • DELETE /api-keys/{id}
These routes return 410 Gone before legacy local key storage is used.

​
Response

​
Current Machine Auth

Use partner API keys for server-to-server calls:

​
Security Boundary

  • Secret API key values live in the partner portal and local or deployed secret managers only.
  • TattooAPI stores non-secret credential identity metadata and actor mappings.
  • Valid keys without a mapped TattooAPI actor return 403.
  • WorkOS key permissions and TattooAPI mapping permissions are separate layers; internal service capabilities are never self-service key scopes.
  • Public writes remain blocked.
Do not store API key values in git, Mintlify, source-pack reports, prompts, screenshots, or public examples.