Authentication

Every API request carries a key as a bearer token in the Authorization header:

curl https://api.taiso.ai/api/v2/projects \
  -H "Authorization: Bearer $TAISO_API_KEY"

Keys are stored only as SHA-256 hashes, so the plaintext is displayed once at creation and never again. If a key is lost, revoke it and issue a new one rather than trying to recover it.

Create and revoke keys →

• 401 — the key is absent, malformed, or revoked. Check that the header is literally Bearer followed by the key.
• 403 — the key authenticated but is not permitted for that resource. A common cause is targeting a project the key's account does not own.

Keys do not expire on a timer, so rotate deliberately. Because more than one key can be active at a time, rotate without downtime: issue the new key, deploy it, confirm traffic has moved, then revoke the old one.

Hub is the identity centre for Taiso products. A product can delegate sign-in to Hub rather than integrating an auth provider itself: it sends the user to Hub with a redirect_url, and after authentication Hub returns them to that URL.

Redirect targets are restricted to an explicit allowlist to prevent open redirects, so a new product host must be registered before its SSO flow will work. Contact the Taiso team to add one.