Most integrations need no platform API at all — the platform calls you.
Reach for this when your product needs to read or write something the
conversation produced.
Workspace API keys
One key per workspace, identifying that workspace. Issued by an operator.
Keys are scoped. A key only reaches what it was granted, and a request
outside its scopes returns 403 naming the missing one:
Keys carry an optional expiry, record their last use, and can be revoked
individually. Only a hash is stored, so a secret is shown exactly once — at
creation.
Store one as you would any server credential: backend only, never in a
browser or mobile client, and revoke it if it is ever exposed. Grant the
minimum scopes a caller needs — that is what decides how bad an exposure is.Keys issued before scopes existed are unscoped and reach the whole
authenticated surface for their workspace. If you hold one, replace it with a
scoped key.
What it does not grant
The ops console and the reseller console are separate and cannot be reached
with a workspace key.
The website widget uses a publishable key (tegain_site_…) which is meant
to be public. It is constrained by an origin allowlist and per-IP rate limits,
and cannot read anything. Never confuse the two. 
