Docs

Authentication

Use a user-scoped personal access token with the minimum required scopes.

Treat tokens as passwords

Personal access tokens are private user-scoped credentials, not public API keys. Anyone who obtains a token can access workspace data and perform every action allowed by its scopes. Never share a token, embed it in client-side code, commit it to source control, or include it in screenshots and logs.

Bearer token

Send the token with every request:

Authorization: Bearer $TETRI_API_TOKEN

Create a token

POST /api/v1/programmatic-access/credentials
Authorization: Bearer $TETRI_SESSION_TOKEN
Content-Type: application/json

{
  "name": "My integration",
  "audience": "programmatic_api",
  "scopes": ["wallets:read"],
  "expires_in_days": 30
}

The plaintext token is returned once. Store it in a secrets manager or protected environment variable.

Revocation

Revoke a credential immediately if it may have been exposed. Changing or resetting your password, or changing your email address, revokes every Public API and MCP credential for your account. Create replacement credentials after the account change.