Authentication

Every request carries an API key as a bearer token:

Authorization: Bearer tinbo_…

A request without a key, or with an unknown or revoked one, gets 401 unauthorized.

What a key may doCopy Anchor Link

• One workspace. A key belongs to the workspace it was created in and only ever sees that workspace's links, tags, folders and domains.
• The admin who created it. A key acts as the admin who created it. If that person leaves the workspace or stops being an admin, the key stops working (403 forbidden): create a new one.
• Full access or read only. A read-only key may only read (GET); anything else gets 403 forbidden. Use read-only keys for reporting and dashboards.
• Pro plan. Keys work while the workspace is on Pro; otherwise every request gets 403 plan_required.

Managing keysCopy Anchor Link

Admins create and revoke keys on the workspace's API & MCP Server page. A key is shown once, when it is created; the page later shows only its last four characters. Revoking a key cuts it off at once.

Treat a key like a password: keep it on your server or in a secret store, never in code a browser downloads. If a key leaks, revoke it and create a new one.

AI assistantsCopy Anchor Link

Assistants such as Claude and ChatGPT connect to the MCP server with your tinbo sign-in instead of a key. They act in the workspace you pick, as you, and appear under Connected apps on the same page, where you can disconnect them.