> ## Documentation Index
> Fetch the complete documentation index at: https://docs.impellabs.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Calling the platform API from your product.

Most integrations need no platform API at all — the platform calls **you**.
Reach for this when your product needs to read or write something the
conversation produced.

## Workspace API keys

```bash theme={null}
curl https://api.impellabs.tech/api/v1/leads/ \
  -H "Authorization: Bearer tgcc_xxxxxxxxxxxx"
```

One key per workspace, identifying that workspace. Issued by an operator.

Keys are **scoped**. A key only reaches what it was granted, and a request
outside its scopes returns 403 naming the missing one:

| Scope                                  | Unlocks                           |
| -------------------------------------- | --------------------------------- |
| `knowledge:read` / `knowledge:write`   | Cards, folders, documents, crawls |
| `assistants:read` / `assistants:write` | Assistant configuration           |
| `leads:read` / `leads:write`           | Leads and lead lists              |
| `chat:read` / `chat:write`             | Conversations                     |

Keys carry an optional expiry, record their last use, and can be revoked
individually. Only a hash is stored, so a secret is shown exactly once — at
creation.

<Warning>
  Store one as you would any server credential: backend only, never in a
  browser or mobile client, and revoke it if it is ever exposed. Grant the
  minimum scopes a caller needs — that is what decides how bad an exposure is.

  Keys issued before scopes existed are unscoped and reach the whole
  authenticated surface for their workspace. If you hold one, replace it with a
  scoped key.
</Warning>

## What it does not grant

The ops console and the reseller console are separate and cannot be reached
with a workspace key.

## Widget keys are different

The website widget uses a **publishable** key (`tegain_site_…`) which is meant
to be public. It is constrained by an origin allowlist and per-IP rate limits,
and cannot read anything. Never confuse the two.