Skip to content
Developers

Authentication

Send the API key Tallyfy gave you in the Authorization header. Managing collections and objects, batch import, recommendations and tasks need the key.

Search doesn’t need it, and neither do the routes for featured objects, per-source object counts and AI overview status. So a search box in a browser can call Tallyfy Answers without exposing your key.

Add the following header to every Tallyfy Answers API request that needs the key:

Authorization: Bearer your_api_key

Replace your_api_key with the API key Tallyfy gave you. The service compares the whole header value with its key, so keep the word Bearer and the single space before the key.

Tallyfy issues your key when you’re onboarded. There’s no screen or endpoint that creates keys, so contact Tallyfy for it.

  • Don’t share your Tallyfy API key in public repositories or client-side code
  • Store your API key in environment variables or secure configuration files
  • Ask Tallyfy to rotate the key if you suspect it’s been compromised
Terminal window
curl -X GET https://answers.tallyfy.com/collections/mycollection \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json"

If you receive a 403 Forbidden response with the body {"error": "Forbidden"}, check that:

  • You’re using the API key Tallyfy gave you
  • You’ve included the Authorization: Bearer header, with one space before the key

A 400 that says the collection name is invalid comes before the key check. It means the name in the URL has characters other than lowercase letters and digits.

Answers > Search

Tallyfy Answers search combines AI semantic understanding with traditional keyword matching, so…