Authentication

Send the key as a bearer token: Authorization: Bearer tab_live_… (or X-Api-Key). Keys never expire on their own; revoke one on your account page when an app is retired. Up to five active keys per account; an account without a verified mobile number holds one. Keys belong to the account, and limits count per account: five keys share one quota. A suspended key answers 403 with the reason; write to developers@truckaurbus.com to discuss it.

Two different doors

API keys authenticate your app reading the catalogue. Login with Truckaurbus authenticates a user into your app with their truckaurbus identity. They are independent; most integrations use one or the other, some use both.

Scopes

Every key carries a list of scopes, set by its tier; a resource answers 403 with the scope it needs when the key lacks it. Ops can narrow a key’s list on request.

Scope	Opens	On
`catalogue:read`	The register, the machines, the work, compare, the words, the Circle	Every tier
`partners:read`	Dealers, PIN codes, breakdown	Every tier
`leads:write`	A buyer’s lead with consent	Every tier
`nazar:read`	Your own fleet on Nazar, and your fleet’s webhooks	Every tier
`nazar:verify`	A roadside check of a truck’s proof code	Every tier
`khali:read`	Your own Khali daala cards, as the owner: open, edit, close, seen	Every tier
`khali:offer`	A card by its code and an offer on it	Every tier
`bulk:read`	The CSV exports	Business, enterprise
`market:read`	The used market, read only	Business, enterprise
`webhooks`	Market and machine events	Enterprise

Start

Use the data

Two different doors

Scopes

​Two different doors

​Scopes

Two different doors

Scopes