Get started

Authentication and API keys

Create a secret API key, choose its permissions and send it in the Authorization header.

1Create an API key

1In the dashboard, open API keys and click New API key.
2Choose the Secret type. It starts with tcb_sk_.
3Choose the Live environment.
4Tick only the scopes your integration uses.
5Optionally, set an expiry date.

The key is shown only once

Copy it and store it on your server, for example in an environment variable. Never put it in your frontend or in a repository.

Terminal

Shell

# Keep it in a server environment variableexport TUCAPI_KEY=tcb_sk_live_…

2Send it with every request

Send the key in the Authorization header with the Bearer scheme:

HTTP

Authorization: Bearer tcb_sk_live_…

A valid key with the right scope gets a 200. Try GET /v1/balance (scope balance:read).

GET /v1/balance

curl "https://api.business.tucapi.com/v1/balance" \  -H "Authorization: Bearer $TUCAPI_KEY"

Response

{  "object": "balance",  "available": {    "amount": "1240.55",    "currency": "USDT"  },  "pending": {    "amount": "120.33",    "currency": "USDT"  },  "updatedAt": "2026-09-15T18:50:31Z"}

Key types

Key	Works with the API?
Secret live `tcb_sk_live_…`	Yes. It's the only one that authorizes calls.
Publishable `tcb_pk_…`	No. Returns `401 publishable_key_not_allowed`.
Any sandbox key	No. Returns `401 sandbox_not_supported`.

Scopes

Each scope unlocks a group of endpoints. Give each integration only what it needs.

Scope	Allows
`orders:write`	Create charges (`POST /v1/charges`) and subscribe or cancel customers on recurring billing.
`orders:read`	Retrieve charges, orders, plans and subscriptions.
`balance:read`	Retrieve the balance.
`statements:read`	List and download fee statements.

If the key lacks the scope, the response is 403 insufficient_scope.

Best practices

Use a different key per integration. That way you can revoke one without touching the others.
If a key leaks, revoke it in the dashboard and create a new one. Revocation is immediate.
Always call the API from your server, never from the browser.

Authentication errors

HTTP	`code`	What happened
401	`missing_api_key`	You didn't send the `Authorization` header.
401	`invalid_api_key`	The key doesn't exist or was revoked.
401	`api_key_expired`	The key has expired.
401	`publishable_key_not_allowed`	You used a publishable key.
401	`sandbox_not_supported`	You used a sandbox key.
403	`insufficient_scope`	The key doesn't have the endpoint's scope.
403	`merchant_not_active`	Your merchant account isn't active.
429	`rate_limited`	Too many failed attempts with the same key. Wait `Retry-After` seconds.

1Create an API key#

2Send it with every request#

Key types#

Scopes#