API Keys
Local TattooAPI API key management is retired.
Machine and private worker credentials are created, rotated, and revoked in the partner portal. TattooAPI validates incoming X-API-Key values, then resolves the non-secret credential identity to a TattooAPI actor mapping.
This is Partner API-key M2M authentication, not OAuth client credentials. TattooAPI validates the key and enforces route permissions, organization access, artist and studio scope, and review boundaries.
Retired Endpoints
Local key management under /api/v1/api-keys and /api/v1/api-keys/{id} returns 410 Gone. Manage keys in the partner portal.
Current Machine Auth
Use partner API keys for server-to-server calls:
Security Boundary
- Secret API key values live in the partner portal and local or deployed secret managers only.
- TattooAPI stores non-secret credential identity metadata and actor mappings.
- Valid keys without a mapped TattooAPI actor return
403.
- Credential permissions and TattooAPI mapping permissions are separate layers; internal service capabilities are never self-service key scopes.
- Public writes remain blocked.
Do not store API key values in git, Mintlify, source-pack reports, prompts, screenshots, or public examples.
