Authentication

Headers

Send both on every authenticated /v1 request:

• X-Tecron-Key — your key id (tk_live_… or tk_test_…)
• X-Tecron-Secret — the secret shown once at create/rotate (ts_…)

You may also use Authorization: Bearer keyId:secret. Never use X-Api-Key.

No browser / no CORS

API keys must not run in a browser. Requests that carry an Origin header receive 403 browser_origin_forbidden. Call Tecron from your server.

Test vs live keys

Contacts writes and broadcasts require a live key.

Idempotency

On template (and broadcast) accept, send Idempotency-Key (8–256 URL-safe characters). The same key + same body returns the original accept response. A changed body with the same key returns idempotency_key_conflict.

Idempotency dedupes HTTP accept. It does not make Graph delivery exactly-once — see Delivery semantics.

Daily caps

Workspace and key daily send limits count messages, not HTTP calls. Broadcasts INCRBY by recipient count. Exhaustion returns 429 plan_quota_exceeded with Retry-After until UTC midnight.

Rotate

Create a new key, migrate traffic, then revoke the old key after the rotation grace window.