Authentication & API keys

Interactive sessions

The console authenticates with GitHub OAuth. On success the API issues a signed session in an HttpOnly cookie scoped to the platform domain, so cloud.tngat.com and api.tngat.com share one session without the browser exposing a token to JavaScript.

API keys

Automation and machines use API keys instead. Create one under Organization → Service accounts. A service account looks like a member — it has a name, a team role and its own keys — but it can never sign in interactively.

curl https://api.tngat.com/api/v1/projects \
  -H "Authorization: Bearer $TNGAT_API_KEY"

Key behaviour worth knowing:

• The secret is shown once, at creation. Store it immediately.
• Keys can be rotated (a new secret on the same key id) and revoked

without touching the service account itself.

• A key inherits the service account's role, so a viewer key cannot mutate

anything — the API returns 403 with an explanation rather than an empty list.

• Bind a key to specific source IPs with the organization IP allowlist if

you want a second factor.

Any request with an invalid or revoked key returns 401 Unauthorized. A valid key without the required permission returns 403 Forbidden and names the missing permission.