API Authentication

Learn how to authenticate your Partner API requests securely.

Authentication Method

The Partner API uses API Keys in prefix.secret format, scoped per project to one or more endpoint groups (events.read, ticket_catalog.read, tickets.read, orders.read).

Send the key as either header:

GET /api/partner/projects/{projectId}/events
Host: api.tixfin.com
X-API-Key: YOUR_API_KEY

or as a bearer token:

GET /api/partner/projects/{projectId}/events
Host: api.tixfin.com
Authorization: Bearer YOUR_API_KEY

Getting Your API Key

1. Log in to app.tixfin.com
2. Open the project → Settings → Partner API
3. Click "Generate API Key"
4. Choose which endpoint groups it can access
5. Copy and save securely (shown once!)

Code Examples

npm install @tixfin/partner-api-client

import { TixfinPartnerClient } from "@tixfin/partner-api-client";

const client = new TixfinPartnerClient({
  projectId: process.env.TIXFIN_PROJECT_ID,
  apiKey: process.env.TIXFIN_PARTNER_API_KEY,
});

const events = await client.listEvents();
console.log(events.items);

pip install tixfin-partner-api

import os
from tixfin_partner_api import TixfinPartnerClient

client = TixfinPartnerClient(
    project_id=os.environ["TIXFIN_PROJECT_ID"],
    api_key=os.environ["TIXFIN_PARTNER_API_KEY"],
)

events = client.list_events()
print(events.items)

curl "https://api.tixfin.com/api/partner/projects/$TIXFIN_PROJECT_ID/events" \
  -H "X-API-Key: $TIXFIN_PARTNER_API_KEY"

See the SDKs guide for the full client reference, or call the REST API directly with any HTTP client.

Error Handling

Common Authentication Errors

Error Response

{
  "message": "Invalid API key",
  "status": 401
}

Security Best Practices

✅ Do This

Store Securely

# Environment variables (recommended)
export TIXFIN_PARTNER_API_KEY="pfx_abc123.s3cr3t..."

Scope Narrowly

• Only grant the endpoint groups (events.read, tickets.read, etc.) a key actually needs
• Create separate keys per integration instead of sharing one broadly

Rotate Regularly

• Rotate keys periodically from Settings → Partner API
• Revoke keys you no longer use

Use HTTPS Only

• Never send keys over HTTP
• Always use https://api.tixfin.com

❌ Don't Do This

Never commit to Git

// ❌ BAD
const apiKey = "pfx_abc123.s3cr3t...";

// ✅ GOOD
const apiKey = process.env.TIXFIN_PARTNER_API_KEY;

Never use client-side

<!-- ❌ BAD - API key exposed to users -->
<script>
  const apiKey = "pfx_abc123.s3cr3t...";
</script>

The Partner API is read-only, but a leaked key still exposes your event, ticket, and order data — treat it like any other secret.

Rate Limits

Exceeding either returns 429 until the window resets.

Need Help?

Can't authenticate?

1. Check the key is correct (copy-paste fresh, no surrounding whitespace)
2. Confirm you're calling the right projectId
3. Verify the key hasn't been revoked or rotated
4. Check the key is scoped for the endpoint group you're calling

Still stuck?

• Email: api@tixfin.com
• Include: your key's prefix only (never the full key), the endpoint you called, the error message

Next Steps