Skip to main content
Every request to the TYAN API must include a valid API key passed as a Bearer token in the Authorization header. API keys are verified through Unkey — there are no cookies, sessions, or OAuth flows, just a single header on every request. If the header is missing, invalid, disabled, or expired, the API returns a 401 Unauthorized response immediately.

​
Getting Your API Key

1

Log in to your workspace

Go to testyourappnow.com and sign in to your account.
2

Navigate to API Keys

Open Settings → Workspace → API Keys in the left-hand navigation.
3

Create a new key

Click Create Key and give it a descriptive name that identifies the integration — for example, GitHub Actions or Staging Monitor.
4

Copy your key immediately

Your full API key is shown only once at creation time. Copy it now and store it in a safe location. If you lose it, you’ll need to revoke the old key and create a new one.

​
Using Your API Key

Pass your API key in the Authorization header of every request using the Bearer scheme. Since every endpoint uses POST with a JSON body, always include Content-Type: application/json as well:
Replace tyan_live_xxxxxxxxxxxx with your actual API key. The key works the same way regardless of which endpoint you’re calling.

​
Security Best Practices

Never commit API keys to source control. If you accidentally expose a key in a public repository, revoke it immediately from Settings → Workspace → API Keys → Revoke and generate a new one.
  • Use environment variables. Store your API key in an environment variable (e.g., TYAN_API_KEY) and read it at runtime rather than hardcoding it in your code.
  • Use a secrets manager. For production deployments, store keys in a dedicated secrets manager such as AWS Secrets Manager, HashiCorp Vault, or GitHub Actions Secrets.
  • Create one key per integration. Assign a separate API key to each service or pipeline that calls the API (CI, a monitoring script, a webhook receiver, etc.). That way, if one key is compromised, you can revoke it without disrupting other integrations.
  • Rotate keys periodically. Even if a key hasn’t been exposed, rotating it regularly limits the window of risk.

​
Authentication Errors