To communicate with the TimeTonic API, you need an API key called a Sesskey (session key), sent with every request. You can create several keys, name them, give them different rights and delete them one by one.
An API key inherits the rights of the account that created it. Generated from an administrator account, it can reach everything that account sees. For an integration, create a dedicated account such as api_<clientname>, limited to the data it actually needs.
This is the recommended method. Open your user profile, then the Settings tab, section API Keys (SessKey).
1
Click Add new API key
A configuration window opens.
2
Name the key
Choose a name that states what it is for: api-make, api-n8n, api-reporting-client. This is what will let you delete the right key months later.
3
Tick the rights you need
See the detail in the next section. Grant only what the integration actually requires.
4
Enter your TimeTonic account password
It is required to confirm the creation.
5
Confirm
The key appears in the list, ready to be copied into your tool.
Choose the rights of the key
Four rights are ticked independently when the key is created:
RightTick it if the integration must...
Can write in TimeTonicCreate or modify data. Untick it for any integration that only reads.
Can read data from TimeTonicRead the content of your tables.
Can read messages from TimeTonicAccess the messaging of your workspaces.
Can read TimeTonic calendar eventsAccess calendar events.
The habit to build: read-only. A dashboard, an export or a reporting tool has no reason to modify your data. Untick Can write in TimeTonic and you get a read-only key. If that key ever leaks, nobody can alter or delete your data with it.
Manage and delete your keys
Each key in the list has three actions:
Copy
Retrieves the key so you can paste it into your tool.
Rename (pencil icon)
Changes the name of the key, without changing its value or interrupting the integration.
Delete (bin icon)
Permanently revokes this key. A confirmation warns you that applications using it will be disconnected. The other keys keep working.
Clean up regularly. Delete the keys you can no longer account for, and rotate the ones you keep. A forgotten key is still an active key.
Limit the data scope as well
The rights of a key define what it can do, not what it can see. A read-only key created from an administrator account can still read everything that account sees.
To restrict the accessible data too, create a dedicated user account for each integration, for example api_<clientname>, give it access only to the filtered views it needs, then generate the key from that account. It is the combination of both, limited rights and a partitioned account, that actually protects you.
An API key can expire. At the bottom of the Settings screen, the Sign out of other sessions option removes every current session of the account: web, mobile and API. Unlike deleting a single key, it cuts all your integrations at once. Keep it for confirmed compromise.
For security reasons, TimeTonic also reserves the right to delete sessions without notice. Web sessions always have a lifetime limited to a few weeks.
Advanced method: create a key from the API site
This method is still available from the dedicated API site. It takes three ordered steps: create an Appkey, then an Oauthkey, then the Sesskey.
Write down each identifier as you go: they are generated only once. If you lose one, you have to start over from the beginning.
1. Create the Appkey
In createAppkey, choose a name for your application in the appname field, then click Submit.