Skip to main content

Authentication

Every request carries an API key in the Authorization header:

Authorization: Bearer tc_live_…

Creating a key​

  1. Open the inbox you want the assistant to answer from.
  2. Go to Settings → Integrations → API access.
  3. Give the key a name (for example "Production") and a source label: a short lowercase word that names your application, such as myapp. The assistant sees it when it reads the notes you attach to a user.
  4. Click Create key and copy it. It is shown once. TrolleyChat stores only a hash, so nobody can read it back later, including us.

A key belongs to exactly one inbox. Every conversation it starts lands in that inbox, and it can read nothing else. If you want a separate knowledge base or a separate team for your application, create a dedicated inbox and a key on it.

Keeping it safe​

  • Keep the key on your server. Never ship it to a browser, a mobile app, or a public repository.
  • If a key leaks, revoke it on the same card and create a new one. Requests with a revoked key are refused immediately.
  • Use one key per environment so you can revoke staging without touching production.

What a key can do​

A key can start conversations for your users in its inbox, send their messages, and read those conversations. It cannot read other conversations in the inbox, change settings, or access anything outside the inbox.