Authentication and access

One key identifies one integration

An administrator manages API keys in the application’s API & integrations page. A key belongs to a group, not to an individual employee. You can create several named keys, set an expiry or no expiry, replace a key, and revoke it. The full secret is displayed once; later the interface shows only its prefix and usage metadata. Keep it in your server-side secret store, never in a browser or mobile application.

Send the key on every partner API request:

Authorization: Bearer YOUR_API_KEY

In Scalar’s Bearer Token field, paste only the key itself. Scalar adds Bearer to the HTTP header automatically. Do not paste a second Bearer prefix into that field.

There is no partner-facing login or refresh-token exchange. TrakarIA validates the key, its permissions, organization status and commercial access. A revoked or expired key cannot be used for subsequent requests. Keep separate keys for separate systems so you can rotate one without interrupting the others.

A launch link still needs a person

The API key authenticates your software. An inspection launch link identifies the inspection to open, but the staff member must also authenticate in the TrakarIA interface. Do not put the API key in the launch URL. Launch links are short lived and can be renewed through the API.

API address

Send requests to https://api.trakaria.com. Read GET /v1/capabilities to see the effective features and limits for a valid key. You can start with a read-only request before creating records in your account.