API keys and webhooks
Create, copy, rename and delete API keys, and add webhook endpoints, in Settings > API.
API keys let a tool outside Tarkle connect to your organization. Your own code, an AI assistant through the MCP server and rclone can each use one. Webhooks send a signed request to an address you choose when something happens to a brand page. Both are managed in Settings > API.
Open Settings > API
Open Settings > API. Only an owner or admin of your organization can make keys. The page lists your API keys, newest first. Below the list is the Webhooks section, which works on one workspace at a time.
Create an API key
Click Create.
In Name, type a name you will recognise, such as Production API.
Under Access, choose All workspaces, or choose Only selected workspaces and tick the workspaces the key may reach.
Click Create.
In the API key created window, click the key to copy it, then click Done.
A key can read and change everything in the workspaces it reaches, through the API and the MCP server. It cannot make purchases. It acts as the person who made it, with that person's roles. A key has no expiry date and no list of permissions to pick. It works until you delete it. Each request names the workspace it works on. The full steps for keys are in their own article.
Manage your keys
Find the key in the list and open the row menu:
Copy token copies the key again. Only an owner or admin can copy a key.
Rename changes the name of the key.
Delete stops the key at once, everywhere it is used. Create the replacement key and put it in your tool before you delete the old one.
A key with a Legacy badge was made before keys had full access. It has fewer permissions, it cannot be copied and it does not open the MCP server. Create a new key to replace it.
Add a webhook
Webhooks belong to one workspace, and only an owner or admin of that workspace can add, change or remove its webhooks. If you have more than one workspace, choose the workspace above the Webhooks table first.
Under Webhooks, click the button that adds a webhook.
In Address, type an https:// address that is reachable from the internet.
In Description (optional), add a short name, such as Zapier.
Under Events, keep All events ticked. To send page views too, tick Also send page views. To choose events one by one, untick All events and tick each event you need.
Click the button that saves the webhook.
In Signing secret (shown once), click the secret to copy it, then click Done.
The events come from brand pages: page views, downloads, brand edits, new access requests, and access requests approved or rejected. All events does not include page views. Use the signing secret to check the Tarkle-Signature header on each request.
Manage webhooks
Each row of the webhook table shows its address, its events, whether it is On or Off, and when it was Last delivered. Open the row's menu for these actions:
Send test sends a test event to the address and shows the answer it gave.
Deliveries lists the latest events sent to the address, kept for 7 days. Click Send again to send one again. It works only while the webhook is on.
New signing secret makes a new secret. The old one keeps working for 24 hours.
Turn off pauses the webhook, and Turn on starts it again.
Delete removes the webhook and its delivery history, and events stop being sent to it.
What happens next
Once a webhook is on, Tarkle sends it the events you chose. A delivery that fails is tried again, and the row shows Failing: retrying until a delivery succeeds. The Last delivered column shows Never until the address answers a delivery.