Authentication

Every request to the Tandem API must be authenticated with a bearer token.

Personal access tokens

A personal access token is a long-lived credential you create for yourself. It authenticates API requests as you, in the organization you created it in, and carries exactly the permissions your own account has — no more.

Creating one

Open the user menu (your avatar, top right) and choose Access Tokens.
Select Create Token, then give it:
- a name you'll recognize in the list (up to 40 characters),
- an optional description of what it's for,
- an expiration — 30, 60, or 90 days, 1 year, or no expiration.
Select Create Token.

Any member of an organization can create their own tokens; you don't need to be an admin. You do need to be a current, active member: if you've been removed or disabled, or your invitation is still pending, creating a token fails with 403 and You are no longer an active member of this organization, even while you're still signed in.

The token is shown once, on the screen that follows. Tandem stores only a hash of it and cannot display or recover it again. Copy it before you leave that screen. If you lose it, revoke the token and create a new one.

Expiration

90 days is the default. An expired token stops authenticating and returns 401 Unauthorized; create a new one to replace it. No expiration is available for the cases that genuinely cannot rotate, but a token with no expiry stays valid until someone revokes it. Prefer a dated token.

Revoking

Select the revoke action on any active token on the Access Tokens page. Revoking takes effect immediately and cannot be undone — anything using that token stops working. Revoked and expired tokens stay in the list so you can tell why a token stopped working rather than finding it gone.

Your tokens are also revoked automatically when you're removed from or disabled in the organization. When an Owner disables you, your tokens in each of its sub-tenants that the Owner also owns are revoked too. Being invited back doesn't restore a revoked token; create a new one.

Limits and rules

You can hold up to 50 active tokens per organization. Revoke one to create another.
Tokens are scoped to a single organization — the one you were working in when you created the token.
Tokens cannot manage tokens. Creating, listing, and revoking are browser-only operations, so a leaked token can't renew itself or lock you out of your own credentials.
Treat a token like your password: never commit it to source control or paste it into a shared document.

Authorization header

Send your token in the Authorization header on every request:

Authorization: Bearer <token>

Requests are scoped to the organization the token belongs to. You can only read and modify resources that belong to your organization.

Example

curl https://api.tandemcx.ai/v1/workflows \
  -H "Authorization: Bearer <token>"

Failed authentication

A missing, malformed, or expired token returns 401 Unauthorized with the standard error envelope:

{
    "error": {
        "code": "UNAUTHORIZED",
        "message": "Authentication is required to access this resource."
    }
}

In the interactive API playground, an invalid or expired token may appear as a network error rather than a clean 401 response. If a playground request fails without a status code, re-check that your bearer token is valid and current.

All traffic must use HTTPS; requests over plain HTTP are rejected.

Authentication

On this page