API key
A long-lived opaque credential (prefix truestamp_) that authenticates programmatic requests as your whole account, sent as an Authorization Bearer header on JSON:API and GraphQL or as a connection parameter on the console WebSocket; the MCP surface never accepts one and requires OAuth 2.1.
Overview
An API key is a long-lived credential you create from your Truestamp account so
a script, server, or scheduled job can authenticate to the API without a browser
sign-in. Every key is a single opaque string beginning with truestamp_,
presented as an Authorization: Bearer header on the
JSON:API and GraphQL surfaces
and as an api_key connection parameter on the
console WebSocket. A key is not scope-limited: it
carries the full authority of your account over the API, so it is treated like a
password. The value is shown exactly once at creation (only a one-way hash is
stored), every key has a required expiry, and revocation is immediate and
permanent. The one surface that never accepts an API key is
MCP, which authenticates with OAuth 2.1 only. See
API keys for programmatic access for creation, expiry,
revocation, the audit trail, and the comparison with OAuth 2.1 tokens.