Authentication and scopes
Control which integrations can access your organisation’s API allowance.
Bearer authentication
Send your API key in the Authorization header on every REST or MCP request:
Authorization: Bearer td_live_your_api_key
Keys in URLs, query strings and cookies are not accepted. Keep keys in backend environment variables or a secret manager. Do not embed them in public websites, mobile app bundles or source control. Browser requests are restricted to Tendex origins; your backend can call the API directly.
Permissions
| Scope | Allows |
|---|---|
| tenders:search | Search tenders |
| tenders:read | Read tender details |
| suppliers:read | Search and read suppliers |
| buyers:read | Search and read buyers |
| frameworks:read | Search and read frameworks |
| comments:read | Read workspace comments |
| comments:write | Create and delete workspace comments |
| pipeline:read | Read accessible pipelines |
| pipeline:write | Create and update pipelines and stages |
| bookmarks:read | Read your bookmarks |
| bookmarks:write | Add and remove your bookmarks |
| saved-searches:read | Read workspace saved searches |
Choose only the permissions an integration needs. Write permissions are opt-in. Existing keys keep their original scopes; create a replacement key to grant additional scopes. MCP tool discovery shows the tools allowed by that key. A write scope never overrides organisation roles or bid permissions. Viewers cannot write.
Organisation access
A key belongs to the organisation where it was created. Switching your active workspace does not move the key. Access is checked on each request. Removing the creator from the organisation disables their keys. Changing to a plan without API access also disables requests.
Expiry, rotation and revocation
Choose 30 days, 90 days or one year when creating a key. To rotate, create a replacement, update the integration, verify a request and revoke the old key. An owner or admin can revoke keys immediately in Settings → Developers, including after a downgrade. Revocation blocks subsequent requests; already accepted requests may finish.
Common responses
401 means the key is missing, invalid, expired, revoked or its creator no longer belongs to the organisation. 403 means a permission or allowed browser origin is missing. 402 means the current subscription does not include API access. None of these responses consumes the monthly allowance.