tempkey

Tempkey API

Everything the dashboard does, scriptable: grant, extend, revoke, verify, and audit contractor access from CI, HR automations, or your own tooling.

1. Create an API key

In the app, open Settings → API keys and create a key. Choose read & write for automation or read only for dashboards and reporting. The secret is shown once — store it in your secret manager.

2. Authenticate

Send the key as a bearer token on every request:

Authorization: Bearer tk_...

GET requests need the read scope; anything that changes state needs write. Keys can be rotated or revoked at any time, and every API action is attributed to its key in the audit log.

3. Call the API

The base URL is https://api.tempkey.io/api/v1. A machine-readable OpenAPI 3 description lives at api.tempkey.io/openapi.json — point your generator or API client at it.

Quick start

Create a 30-day grant across GitHub and GitLab, revoke it early, and pull the evidence:

curl -X POST https://api.tempkey.io/api/v1/grants \
  -H "Authorization: Bearer tk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "contractor": { "name": "Ada Lovelace", "email": "ada@studio.example" },
    "durationDays": 30,
    "access": [
      { "provider": "github", "permission": "direct_member" },
      { "provider": "gitlab", "permission": "developer" }
    ]
  }'
curl -X POST https://api.tempkey.io/api/v1/grants/GRANT_ID/revoke \
  -H "Authorization: Bearer tk_YOUR_KEY"
curl "https://api.tempkey.io/api/v1/audit?limit=50" \
  -H "Authorization: Bearer tk_YOUR_KEY"

Revocation is verified, not assumed: after each revoke Tempkey reads the provider's state back, and the per-tool result (including failures) is returned and logged.

Grants

The core resource: time-boxed contractor access. Creating a grant provisions access in every requested tool and schedules automatic revocation at expiry.

MethodPathDescription
GET/grantsList grants
POST/grantsCreate a grant (contractor + expiry + tools)
GET/grants/{grantId}Get a grant with per-tool access state
POST/grants/{grantId}/extendMove the expiry later (native tool expiries are synced too)
POST/grants/{grantId}/revokeRevoke now in every tool, then verify by reading provider state back
PATCH/grants/{grantId}/access/{provider}Change the permission for one tool on a grant
POST/contractors/{contractorId}/grantsRe-grant a past contractor

Integrations & providers

Connect provider admin credentials (write-only, encrypted at rest) and inspect what each provider can enforce.

MethodPathDescription
GET/providersCapability metadata for every provider
GET/integrationsList connected integrations (tokens are never returned)
POST/integrationsConnect a provider credential
POST/integrations/{provider}/healthRe-check a connection
DELETE/integrations/{provider}Disconnect (affected grants are marked unenforceable)

Audit trail

Every grant, extension, revocation, verification, and API-key action lands in the append-only audit log.

MethodPathDescription
GET/auditList audit events (newest first)
GET/audit.csvExport as CSV
GET/audit.pdfExport as PDF

API keys

Manage the keys themselves — from the dashboard or from the API. Secrets are shown once and stored only as a hash.

MethodPathDescription
GET/api-keysList keys (metadata only)
POST/api-keysCreate a key — returns the one-time secret
POST/api-keys/{keyId}/rotateSwap the secret in place; the old one stops working immediately
DELETE/api-keys/{keyId}Revoke a key permanently

Workspace

Read and update workspace defaults: timezone, default expiry hour, and notification schedule.

MethodPathDescription
GET/workspaceGet workspace settings
PUT/workspaceUpdate workspace settings

Errors

Errors return JSON with an error message. 401 means the key is missing, invalid, expired, or revoked; 403 means the key lacks the required scope or targets another workspace; 402 means the plan's active-grant limit is reached; 422 means a requested provider isn't connected yet.