Authentication
Authenticate using an API key or an OAuth access token.
API keys
API keys are 64 hex characters (32 bytes). That’s ~256 bits of entropy (effectively unguessable). They are generated using cryptographically secure randomness and stored as a hash, so the raw key cannot be recovered after creation. Send them using one of these headers:
- Authorization: Bearer YOUR_API_KEY
- X-TB-Api-Key: YOUR_API_KEY
- X-API-Key: YOUR_API_KEY
We recommend sending Accept: application/json on every request.
Treat API keys like passwords. Keep them server-side, never embed them in public frontends, and rotate them if you suspect they were leaked.
Request
curl -s https://api.twentybaan.com/v1/me/ \
-H "Accept: application/json" \
-H "Authorization: Bearer YOUR_API_KEY"OAuth
OAuth access tokens are also sent as Bearer tokens. Tokens can have scopes. Endpoints return 403 if the required scope is missing.
Scopes
Scopes are enforced for OAuth tokens and API keys. When you create an API key, pick the smallest set of scopes you need.
- read:me (Me)
- read:listings (Listings)
- read:contact_messages (Contact messages)
- read:contracts (Contracts)
- read:api_keys (API keys)
- read:saved_lists (Saved lists)
- read:saved_list_items (Saved list items)
- webhooks:manage (Webhooks)