Skip to main content
Every API request must include a bearer token in the Authorization header. Tikk supports two credential types. API keys for your own scripts and server-to-server integrations. OAuth access tokens for partner apps acting on behalf of another user. Both use the same bearer token format, so the request structure is the same.

​
Sending credentials

Include your credential in the Authorization header of every request:
Here is a complete example using curl:

​
API keys

API keys are the simplest credential type. They are tied to your own Tikk account, never expire on their own and carry the scopes you pick when you create them. Use them for scripts, automation and any server-side integration where you are accessing your own data.
1

Open API Keys settings

Go to Settings → API Keys in your Tikk account dashboard.
2

Create a new key

Click Create new key, give it a descriptive name (for example, zapier-integration or analytics-script) and choose its scopes. Give it only what the integration needs.
3

Copy the key immediately

Copy the key. It starts with tikk_sk_ and is shown only once. Tikk does not store the raw value, so you can’t retrieve it after closing the dialog.
4

Store the key securely

Save the key in your environment variables or a secrets manager (such as AWS Secrets Manager, HashiCorp Vault or a .env file that is excluded from version control).
Never embed an API key in client-side code, mobile app binaries or version control. Anyone who obtains the key can read your Tikk data until you revoke it. If a key is ever exposed, revoke it immediately in Settings → API Keys and create a replacement.

​
OAuth 2.0 (for partner apps)

If you’re building an app that other Tikk users connect to, use OAuth 2.0 with the authorization code flow. Your users approve your app on Tikk’s consent screen and Tikk issues an access token your app uses on their behalf. Partner apps are registered and documented in the developer portal. There you create a developer account, register your app and get a client ID and client secret. The portal also covers the full OAuth flow, token lifetimes, refreshing and sandbox apps.

Developer portal

Register an app and follow the OAuth guide for partner integrations.
Once you have an access token, you call the endpoints in this reference exactly as you would with an API key.

​
Credential scope and user isolation

A credential (API key or OAuth token) can only access data owned by the user it belongs to. You can’t use your own API key to read another user’s profile, availability or bookings. Requests for resources outside your account return 404, not 403, so the existence of other users’ data is never revealed.
See the Scopes page for the full list of available scopes, which endpoints require them and what happens when a required scope is missing.