Authentication

Every route in the API Reference accepts either a browser session cookie (used by the Threadliner dashboard itself) or an API key. For anything outside the dashboard — scripts, backend integrations, the WordPress plugin — use an API key.

Creating a key

1. In Threadliner, go to Settings → API Keys.
2. Click Create API key, give it a name (e.g. zapier, internal-script), and confirm.
3. Copy the key immediately — it starts with tl_live_ and is only ever shown once. Threadliner stores a hash of it, not the raw value, so there's no way to retrieve it again later if you lose it. Create a new one instead.

{
  "id": "cms7wqfte00048o3zfzwlern8",
  "name": "docs-test-key",
  "key": "tl_live_vuduwCF0syAi_RApRf9CmoItov7twVHd",
  "createdAt": "2026-07-30T19:29:20.018Z"
}

Using a key

Send it as a bearer token on every request:

curl https://api.threadliner.io/contacts \
  -H "Authorization: Bearer tl_live_vuduwCF0syAi_RApRf9CmoItov7twVHd"

A key has full access to its tenant — the same permissions as the tenant owner. There are no scopes or read-only keys yet: any key that can read data can also write and delete it.

Managing keys

Settings → API Keys lists every key's name and last-used timestamp (never the key itself — that's only shown once, at creation). Revoking a key from there takes effect immediately; any request already using that key starts failing with 401 Unauthorized on its next call.

There's no key rotation grace period — if you're replacing a key in production, create the new one and update your integration before revoking the old one.