Authentication

Send the key in the Authorization header of every call, on https://api.tickply.com/v1 only:

Authorization: Bearer tkp_your_key

Keys start with tkp_, so secret scanners can spot one that leaked into code.
The owner of the organizer creates and revokes keys in Settings → Technical → Integrations, under Access keys. The key is shown once, and only its hash is stored: if you lose it, revoke it and create another.
A key can expire after 90 days or 1 year, or never. Revoking stops it at once.
A key belongs to one organizer and sees only that organizer: anything else answers 404 not_found.
If the organizer is suspended or closed, its keys still read, and writing answers 403 organization_suspended.

There are no cookies or sessions at the API address. A key sent to the panel address answers 401 wrong_address, with the right address in address:

{ "code": "wrong_address", "message": "…", "address": "https://api.tickply.com/v1" }

Scopes

Each key has scopes, and each endpoint needs one: the reference shows which. A write scope also reads. A missing scope answers 403 missing_scope, with the scope in required_scope.

Scope	What it opens
`events:read`	Read events, with their days, program, ticket types and batches.
`events:write`	Create and change events, publish them and take them off sale, and add ticket types and batches.
`courses:read`	Read courses, with their spot types.
`courses:write`	Create and change courses, publish them and take them off sale, and add spot types.
`orders:read`	Read orders and their lines.
`orders:write`	Give complimentary tickets and spots.
`participants:read`	Read participants.
`checkins:read`	Read check-ins.
`checkins:write`	Record check-ins, for an external gate system.
`certificates:read`	Read certificates.
`certificates:write`	Issue and revoke certificates.
`coupons:read`	Read coupons.
`coupons:write`	Create coupons.
`webhooks`	Manage webhook endpoints and see their deliveries.

A key belongs to one organizer and sees only that organizer. Scopes for more resources arrive with them; a key never promises what the API does not do yet.