Authentication
The Partner API authenticates with API keys. You create an API key in the Taiga developer portal and send it as a Bearer token on every request. There is no token-exchange step.
Create an API key
Taiga cannot show the key again after creation. If it is lost or exposed, revoke it from the developer portal and create a new one. Revocation takes effect immediately.
API keys are scoped to your Taiga organization. Every request made with a key is limited to that organization’s configured billing-provider NPIs. You do not pass an organization override in API requests.
Use the API key
Include the key in the Authorization header on every request:
cURL
TypeScript
Authentication failures
Authentication fails closed. A request can fail if:
Store API keys in a secret manager and rotate them if exposed. Audit logs only reference key IDs, never the key value itself.