Tempkey API
Everything the dashboard does, scriptable: grant, extend, revoke, verify, and audit contractor access from CI, HR automations, or your own tooling.
1. Create an API key
In the app, open Settings → API keys and create a key. Choose read & write for automation or read only for dashboards and reporting. The secret is shown once — store it in your secret manager.
2. Authenticate
Send the key as a bearer token on every request:
Authorization: Bearer tk_...GET requests need the read scope; anything that changes state needs write. Keys can be rotated or revoked at any time, and every API action is attributed to its key in the audit log.
3. Call the API
The base URL is https://api.tempkey.io/api/v1. A machine-readable OpenAPI 3 description lives at api.tempkey.io/openapi.json — point your generator or API client at it.
Quick start
Create a 30-day grant across GitHub and GitLab, revoke it early, and pull the evidence:
curl -X POST https://api.tempkey.io/api/v1/grants \
-H "Authorization: Bearer tk_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{
"contractor": { "name": "Ada Lovelace", "email": "ada@studio.example" },
"durationDays": 30,
"access": [
{ "provider": "github", "permission": "direct_member" },
{ "provider": "gitlab", "permission": "developer" }
]
}'curl -X POST https://api.tempkey.io/api/v1/grants/GRANT_ID/revoke \
-H "Authorization: Bearer tk_YOUR_KEY"curl "https://api.tempkey.io/api/v1/audit?limit=50" \
-H "Authorization: Bearer tk_YOUR_KEY"Revocation is verified, not assumed: after each revoke Tempkey reads the provider's state back, and the per-tool result (including failures) is returned and logged.
Grants
The core resource: time-boxed contractor access. Creating a grant provisions access in every requested tool and schedules automatic revocation at expiry.
| Method | Path | Description |
|---|---|---|
GET | / | List grants |
POST | / | Create a grant (contractor + expiry + tools) |
GET | / | Get a grant with per-tool access state |
POST | / | Move the expiry later (native tool expiries are synced too) |
POST | / | Revoke now in every tool, then verify by reading provider state back |
PATCH | / | Change the permission for one tool on a grant |
POST | / | Re-grant a past contractor |
Integrations & providers
Connect provider admin credentials (write-only, encrypted at rest) and inspect what each provider can enforce.
| Method | Path | Description |
|---|---|---|
GET | / | Capability metadata for every provider |
GET | / | List connected integrations (tokens are never returned) |
POST | / | Connect a provider credential |
POST | / | Re-check a connection |
DELETE | / | Disconnect (affected grants are marked unenforceable) |
Audit trail
Every grant, extension, revocation, verification, and API-key action lands in the append-only audit log.
| Method | Path | Description |
|---|---|---|
GET | / | List audit events (newest first) |
GET | / | Export as CSV |
GET | / | Export as PDF |
API keys
Manage the keys themselves — from the dashboard or from the API. Secrets are shown once and stored only as a hash.
| Method | Path | Description |
|---|---|---|
GET | / | List keys (metadata only) |
POST | / | Create a key — returns the one-time secret |
POST | / | Swap the secret in place; the old one stops working immediately |
DELETE | / | Revoke a key permanently |
Workspace
Read and update workspace defaults: timezone, default expiry hour, and notification schedule.
| Method | Path | Description |
|---|---|---|
GET | / | Get workspace settings |
PUT | / | Update workspace settings |
Errors
Errors return JSON with an error message. 401 means the key is missing, invalid, expired, or revoked; 403 means the key lacks the required scope or targets another workspace; 402 means the plan's active-grant limit is reached; 422 means a requested provider isn't connected yet.