"API keys"

• The environment key (tthr_dev_..., tthr_prod_...) is created with the environment and has full access to it. It works exactly as it always has. Regenerate it from Settings → Danger zone.
• Scoped keys (tthr_sk_...) are extra keys you create for a single integration, each limited to the scopes it needs. An environment can have as many as you like, and each can expire, be rotated or be revoked on its own.

Both are used the same way: as a bearer token, against routes for their own project and environment.

curl https://api.tetherdb.co.uk/api/v1/projects/$PROJECT_ID/env/production/query \
  -H "Authorization: Bearer tthr_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "function": "posts.list", "args": {} }'

A key only works for its own environment. A request naming another environment in the URL gets 403. Routes without an environment in the URL use the project's default environment, so a key for any other environment must use the /env/{name}/ form of the route. The exceptions are query, mutation and assets, which always use the key's own environment.

Scopes

Scope	Allows
read	Read data, schema, logs, crons, backups and settings. Run queries, including the built-in CRUD reads.
write	Everything in read, plus inserting, updating and deleting data, mutations and raw SQL.
functions	Call deployed query and mutation functions, deploy functions and schema, and trigger crons. On its own it can't use the built-in CRUD functions or read data directly.
admin	Everything the environment key can do, including variable values, database exports and environment settings.

Combine scopes as needed. A CI pipeline that deploys usually needs only functions; a reporting job usually needs only read.

Keys can't create, rotate or revoke other keys; that needs a person with the admin or owner role.

Managing keys

Open Settings → API keys in a project, pick the environment and choose New key. Give it a name, choose its scopes and, optionally, an expiry. The secret is shown once: copy it before closing the panel. Tether only stores a hash of it.

• Rotate replaces the secret. The old one stops working straight away; the name, scopes and expiry stay the same.
• Revoke switches the key off for good. Revoked keys stay in the list for reference.
• Last used is updated at most once a minute.

Deleting an environment or project deletes its scoped keys too.

Developers can see the list of keys; admins and owners can create, rotate and revoke them. Every change is recorded in the audit log.

API reference

Method	Path	Body
GET	/api/v1/projects/{id}/env/{env}/keys
POST	/api/v1/projects/{id}/env/{env}/keys	{ "name": "CI deploys", "scopes": ["functions"], "expiresAt": "2027-01-01T00:00:00Z" }
POST	/api/v1/projects/{id}/env/{env}/keys/{keyId}/rotate
DELETE	/api/v1/projects/{id}/env/{env}/keys/{keyId}

Creating and rotating return the secret once:

{
  "key": {
    "id": "...",
    "name": "CI deploys",
    "hint": "tthr_sk_3f9a…b21c",
    "scopes": ["functions"],
    "expiresAt": "2027-01-01T00:00:00.000Z"
  },
  "secret": "tthr_sk_..."
}