API keys

Create, rotate, and revoke keys.

API keys authenticate your server to Tally. They’re scoped per account and split between test (sk_test_…) and live (sk_live_…) modes. Keep both prefixes in your env so you can swap modes by flipping a single variable.

Creating a key

From the dashboard, API keys → New key. The plaintext is shown exactly once — store it in your secret manager immediately.

Rotation

Tally supports a 24-hour rotation window: when you create a new key, the previous one keeps working for 24 hours so you can roll your fleet without dropped requests.

1. Generate the new key

   Create a new API key from the dashboard. Copy the plaintext value.

2. Deploy with the new key

   Update TALLY_API_KEY in your secret store and roll out.

3. Revoke the old one

   Once every instance is on the new key, revoke the old key.

Revocation

Revocation is immediate and irreversible. Make sure no instance is still using the key before revoking.

Scopes (roadmap)

Today, keys are full-access per account. Per-resource scopes (read-only, payment-only) are tracked on the roadmap. If you need them sooner, talk to us.

Detecting leaked keys

If you accidentally commit a key, rotate it within minutes — Tally automatically scans public commits for leaked credentials and revokes them, but the safer path is to rotate yourself the moment you notice.

Best practices

• Use environment variables, not hardcoded strings.
• Never ship a key in a client bundle. Tally’s SDK is server-only.
• Separate test and live keys across staging and production environments — never mix.