Authentication

The Tickr public API uses API keys (bearer tokens). Every request must carry the key in the Authorization header:

Authorization: Bearer tkr_live_<random>

Creating an API key

1. Sign in to Tickr as Owner or Admin — only those two roles can mint or revoke API keys.
2. Open Settings → API keys.
3. Click Create key, give it a label, pick the role the key should carry, and copy the value shown once. We store only a hash; we cannot show it again.

Scope

• A key is scoped to one workspace — the workspace the creator was in when the key was minted.
• The creator explicitly assigns the role carried by the key at creation time. Allowed values: admin, project_lead, analyst, workspace_user. The owner role is not permitted for API keys (defence in depth — a leaked key must never be able to transfer ownership or delete the workspace).
• The role is fixed for the lifetime of the key. To change it, delete the key and create a new one with the desired role.
• A key cannot be used for endpoints not under /api/v1/.... API-key callers also cannot manage API keys themselves — that requires a session cookie.

Rotation

There is no in-place rotation. Create a new key, switch your integration to it, then delete the old key. Deletion is immediate and irrevocable.

Revocation

Delete the key from Settings → API keys. Subsequent calls with that key return 401 unauthorized.

Last-used timestamp

We record last_used_at on every successful request. It is visible in the Settings UI and helps you spot dormant keys.

Example

curl -sS https://tickr.coderise.cloud/api/v1/projects \
  -H "Authorization: Bearer tkr_live_<random>" \
  -H "Accept: application/json"