Authentication

The Tallymark API uses API keys to authenticate requests. Each key belongs to one account and works on that account's data. Create and revoke keys in Tallymark under Settings → Developers. The full key is only shown once, so copy it right away.

Send the key as a bearer token in the Authorization header of every request.

curl https://api.tallymark.com/account \
  -H "Authorization: Bearer $TALLYMARK_API_KEY"

When you create a key, choose its access:

• Read only keys can make GET requests, to list and show records.
• Read & write keys can also make POST requests, to create, update, send, pay, and delete.

Your API keys can read and change your billing data, so keep them secret. Don't put them in client-side code, mobile apps, or source control. Store them in your server's secrets manager or in an environment variable. If a key leaks, revoke it and create a new one. A revoked key stops working right away.