Authentication

Authenticate using an API key or an OAuth access token.

API keys

API keys are 64 hex characters (32 bytes). That’s ~256 bits of entropy (effectively unguessable). They are generated using cryptographically secure randomness and stored as a hash, so the raw key cannot be recovered after creation. Send them using one of these headers:

  • Authorization: Bearer YOUR_API_KEY
  • X-TB-Api-Key: YOUR_API_KEY
  • X-API-Key: YOUR_API_KEY

We recommend sending Accept: application/json on every request.

Treat API keys like passwords. Keep them server-side, never embed them in public frontends, and rotate them if you suspect they were leaked.

Request

GET
/v1/me/
curl -s https://api.twentybaan.com/v1/me/ \
  -H "Accept: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY"

OAuth

OAuth access tokens are also sent as Bearer tokens. Tokens can have scopes. Endpoints return 403 if the required scope is missing.

Scopes

Scopes are enforced for OAuth tokens and API keys. When you create an API key, pick the smallest set of scopes you need.

  • read:me (Me)
  • read:listings (Listings)
  • read:contact_messages (Contact messages)
  • read:contracts (Contracts)
  • read:api_keys (API keys)
  • read:saved_lists (Saved lists)
  • read:saved_list_items (Saved list items)
  • webhooks:manage (Webhooks)
tb twentybaan

Sign in to your account

Not a member? Create an account

Or continue with email

Uncheck on shared devices.