API Authentication

The API uses two authentication methods depending on the context.

1. API Keys (Server-to-Server)

For backend integrations, moderation bots, and webhook consumers. Generate in your dashboard under Settings → API Keys.

curl -X GET https://api.threadline.io/v1/sites \
  -H "Authorization: Bearer tlk_live_abc123def456" \
  -H "Content-Type: application/json"

• Keys start with tlk_live_ (production) or tlk_test_ (test)
• Send as X-API-Key or Authorization: Bearer
• Scoped to your account — can access all your sites
• Never expose API keys in client-side code.

Multi-language examples

List or create comments with an API key:

curl -X GET "https://api.threadline.io/v1/comments?thread_url=https%3A%2F%2Fexample.com%2Fpost&site_id=site_abc123" \
  -H "X-API-Key: tlk_live_abc123def456" \
  -H "Content-Type: application/json"

# Or:
# -H "Authorization: Bearer tlk_live_abc123def456"

curl -X POST "https://api.threadline.io/v1/comments" \
  -H "Authorization: Bearer tlk_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{
    "thread_url": "https://example.com/post",
    "site_id": "site_abc123",
    "content": "Hello from the API"
  }'

2. User Sessions (Widget/Client)

• Guest mode: No auth token. Comment associated with IP and display name.
• Email magic link: Widget sends a link, sets a short-lived session cookie on click.
• SSO (Publisher+): Your backend generates a TIP identity token, passed via data-identity-token. See identity schema.

Rate Limits

Rate limit info is included in response headers:

HTTP/1.1 200 OK
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 997
X-RateLimit-Reset: 1698765432