ℹ Language notice: Developer documentation on this page is currently maintained in Turkish. Code samples, HTTP headers and URLs are language-neutral; narrative sections will be translated to English. If you need help right now, email admin@teknikdanisman.net.

Authentication

Access the Teknik Danışman REST API using a tenant-scoped Bearer token. This guide walks you through generating your first key and making your first successful request, step by step.

Quick start

1

Go to the API Keys page

Log in to the panel with admin privileges → from the left menu API & Webhooks → API Keys.

Separate key per tenant — in a shared SaaS environment each customer's key accesses only their own DB; no cross-tenant reads.

2

Create a new key

Click "New Key" → enter a descriptive label (e.g. billing-automation-prod). This is just for your own reference.

Select a scope (details below):

  • read — GET only
  • write — POST/PUT/DELETE
  • admin — read + write (broadest)

You can select multiple scopes (e.g. read + write).

3

Copy the key — one time only

The full token is shown only once on the response screen. Format:

tdk_a1b2c3d4e5f67890abcdef0123456789abcdef01

Structure: tdk_ (prefix) + 8 hex (ID, visible in the panel list) + 32 hex (secret, only its SHA-256 hash is stored).

⚠️ If you lose the token You cannot recover it — only the prefix is shown, never the secret. Revoke the old key and generate a new one.
4

Make your first request

Start with a health-check:

curl -i https://teknikdanisman.net/api/v1/ping.php \
  -H "Authorization: Bearer tdk_..."

Successful response:

HTTP/1.1 200 OK
Content-Type: application/json
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 99
X-RateLimit-Reset: 1718983800

{"ok":true,"api_version":"v1","service":"teknik-danisman","time":"2026-06-22T14:30:01Z"}

Scope system

Every endpoint requires at least one scope. If the key has the admin scope it has access to all.

ScopeAccessTypical use
read GET /customers.php, /employees.php, /hardware.php, /ping.php Read-only dashboards, reporting, data export
write POST/PUT/DELETE — record creation, update, deletion; /renew.php Automated provisioning, CRM synchronisation, creating records from external systems
admin All access above + sensitive endpoints to be added in the future Trusted backend services only. Do not use in customer-facing applications.
Principle of least privilege For read-only integrations read is sufficient — do not grant write access. The damage from a compromised key is proportional to its scope.

Security best practices

Rotation (rule: every 90 days)

Regular rotation reduces the breach window. Recommended procedure:

  1. Create a new key with the same scope (e.g. billing-prod-v2).
  2. Update the integration configuration with the new key and deploy.
  3. Verify the new key is working (audit log → are there requests?).
  4. Revoke the old key (API Keys → "Revoke"). This is irreversible.
Webhook secret rotation is different When a webhook secret is changed, the old secret is sent in the X-TD-Signature-Previous header for 72 hours. Details: Webhook Catalog → Secret rotation.

Rate limit

100 requests / minute per key (sliding window). Each successful response includes:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 73
X-RateLimit-Reset: 1718983800     # epoch (UTC seconds)

When exceeded: 429 + Retry-After: 60. Production integrations should monitor Remaining and apply backoff.

Frequently asked questions

How do I find which tenant a key is linked to?

On the API Keys page, each key shows the tenant it was created under, the date, and the scope list.

Can a key access more than one tenant?

No. Each key is linked to a single tenant. For multi-tenant integrations, generate a separate key per tenant.

Can I use the key in a client-side application (SPA, mobile)?

No, never. The key can be extracted via browser DevTools or APK decompilation. Set up a proxy/middleware in your own backend instead.

Does the key expire?

By default it is active indefinitely. It works until revoked. Rotation every 90 days is recommended for production use.

Next steps