Authentication and scopes

Send the token in the Authorization header of every request:

Authorization: Bearer tixxy_live_...

Tokens starting with tixxy_live_ work with real data; tixxy_test_ tokens only with test data.

What a token can do

A request only succeeds when all of these allow it:

Check	Where it is set
The token's organisation	Chosen when creating the token. Other organisations do not exist for it.
The token's scopes	Chosen when creating the token.
The owner's permissions	The permission groups of the person who created the token, checked live on every request.
The owner's event restrictions	Members limited to some events only see those events.
The token's event selection	Optional, set when creating the token.
The token's IP allowlist	Optional, set when creating the token.

Objects outside the token's organisation or events return 404, not 403, so a token cannot find out they exist.

A token stops working when its owner leaves the organisation, loses API access or when it expires.

Scope	Allows
`events:read`	List and retrieve events
`events:write`	Create and update events
`ticket-types:read`	List and retrieve ticket types
`ticket-types:write`	Create, update and delete ticket types
`orders:read`	List and retrieve orders
`orders:write`	Create, cancel and resend orders (fees apply)
`tickets:read`	List and retrieve tickets, including check-in status
`tickets:write`	Invalidate tickets and resend download links
`attendees:read`	Include personal data (names, email, form answers) in orders, tickets and guest list entries
`check-ins:write`	Check tickets in
`promocodes:read` / `promocodes:write`	Read and manage promo codes
`products:read`	List and retrieve products
`guest-lists:read`	List and retrieve guest list entries
`reports:read`	Sales summary per event
`webhooks:manage`	Manage webhook endpoints

Without attendees:read, personal data is left out of every response.

GET /v1/me returns the token's organisation, owner, scopes and limits.