Authentication

API Keys

All requests to the Tartini API are authenticated via an API key. Keys are generated in the Dashboard and associated with a company.

pyp_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4

All keys start with the pyp_live_ prefix followed by 48 hexadecimal characters.

Include your API key in the Authorization header of every request:

curl -X GET https://api-talk.saninternet.com/v1/api/status \
  -H "Authorization: Bearer pyp_live_SUA_API_KEY"

Never expose your API key in frontend code, public repositories, or logs. Treat it like a password.

In addition to the key being valid, the API checks whether the company’s subscription is active. Companies with an inactive subscription receive:

{
  "statusCode": 403,
  "error": "SubscriptionInactive",
  "message": "Sua assinatura não está ativa",
  "subscriptionStatus": "CANCELLED"
}

Code	Error	Cause
`401`	`Missing API key`	Missing `Authorization` header
`401`	`Invalid API key format`	Incorrect format (must be `Bearer pyp_live_...`)
`401`	`Invalid or expired API key`	Nonexistent or revoked key
`403`	`SubscriptionInactive`	Inactive company subscription

Use environment variables

Never put your API key directly in your code. Use environment variables:

export SANTALK_API_KEY="pyp_live_SUA_API_KEY"

const apiKey = process.env.SANTALK_API_KEY;

Rotate keys periodically

Create a new key in the Dashboard, update your systems, and revoke the old key.

Use different keys per environment

Keep separate keys for development, staging, and production.