Authentication

The Tachapps API uses Bearer token authentication. Every request must include a valid API token in the Authorization header.

Obtaining a Token

Tokens are generated from the Tachapps UI:

Navigate to Settings → API Tokens
Click Generate New Token
Give the token a descriptive name (e.g., ci-pipeline, python-notebook)
Set an optional expiration date
Click Generate
Copy the token immediately — it will not be shown again

CAUTION

Treat API tokens like passwords. Never commit them to source control. Use environment variables or a secrets manager.

Using a Token

Include the token in the Authorization header of every request:

http

GET /api/v1/projects HTTP/1.1
Authorization: Bearer tach_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Example — cURL

bash

curl https://your-org.tachyus.com/api/v1/projects \
  -H "Authorization: Bearer $TACHAPPS_API_TOKEN"

Example — Python

python

import httpx

token = os.environ["TACHAPPS_API_TOKEN"]
base_url = "https://your-org.tachyus.com/api/v1"

client = httpx.Client(
    base_url=base_url,
    headers={"Authorization": f"Bearer {token}"}
)

projects = client.get("/projects").json()

Example — JavaScript

const token = process.env.TACHAPPS_API_TOKEN;

const response = await fetch('https://your-org.tachyus.com/api/v1/projects', {
  headers: { Authorization: `Bearer ${token}` }
});

const projects = await response.json();

Token Scopes

Tokens can be scoped to limit access:

Scope	Description
`read:projects`	List and read projects
`read:wells`	List and read wells
`read:production`	Read production data
`write:projects`	Create and update projects
`write:wells`	Create and update wells
`admin`	Full access

When generating a token, select only the scopes required for your use case.

Token Expiration & Rotation

Tokens with an expiration date automatically become invalid after the set date
Rotate tokens regularly for long-running integrations
Revoke a token at any time from Settings → API Tokens → Revoke

Error Responses

HTTP Status	Code	Meaning
`401 Unauthorized`	`UNAUTHORIZED`	Token is missing or invalid
`403 Forbidden`	`FORBIDDEN`	Token lacks required scope
`429 Too Many Requests`	`RATE_LIMITED`	Rate limit exceeded

Authentication ​

Obtaining a Token ​

Using a Token ​

Example — cURL ​

Example — Python ​

Example — JavaScript ​

Token Scopes ​

Token Expiration & Rotation ​

Error Responses ​

Next Steps ​