Authentication

Every call to the Tylode API needs a token. For your own scripts, the MCP server and personal tools, use a personal access token; for apps that other people connect to their account, use OAuth.

#Personal access tokens Pro

A personal access token acts as you, with everything you can do in the app, across all your workspaces. It looks like this:

tylode_pat_Q2x5b0x7bVJ3dFp6c2hLd0R1a0N2bXhQeU5aT2dIc1E

Tokens don't expire. They keep working until you revoke them, or until your account stops being on Pro.

#Create a token

1. Open Settings → API and webhooks → API and plugins (go there).
2. Under Personal access tokens, type a name that tells you where you'll use it, such as "Local MCP" or "Invoices script".
3. Click Create token.
4. Copy the token right away. As the app says, you won't be able to see it again after closing the notice. If you lose it, revoke it and create a new one.

If your account is on Free, you'll see an invitation to upgrade instead of the form. See Plans.

#See and revoke your tokens

The list under Personal access tokens shows, for each token, its name, the first characters (tylode_pat_Q2x5b…), the date it was created and the date it was last used. Tokens you never use don't show a last-used date, which makes it easy to spot the ones you can remove.

To revoke a token, click the trash icon (Revoke token) and click again to confirm. It stops working on the next request. Revoking can't be undone.

#The plan is checked on every request

Tokens need your account to be on Pro or Premium, and Tylode checks it on every request, not only when you create the token. If you move to Free, your tokens stay in the list but every call returns 403. When you go back to Pro, the same tokens work again without any changes.

#Send the token

Put the token in the Authorization header with the Bearer scheme:

Authorization: Bearer tylode_pat_xxx

curl https://app.tylode.com/api/v1/workspaces \
  -H "Authorization: Bearer tylode_pat_xxx"

const res = await fetch("https://app.tylode.com/api/v1/workspaces", {
  headers: { Authorization: `Bearer ${process.env.TYLODE_TOKEN}` },
});

import os, requests

res = requests.get(
    "https://app.tylode.com/api/v1/workspaces",
    headers={"Authorization": f"Bearer {os.environ['TYLODE_TOKEN']}"},
)

Tokens aren't accepted in the URL or in the body; only the header works.

#Keep your tokens safe

A personal access token can read and change everything you can: every page, board, chat and mail thread in all your workspaces. Treat it like a password.

• Keep it out of your code. Load it from an environment variable or a secrets manager, and never commit it to a repository.
• Never ship it to a browser or an app. Anyone can read what's in front-end code or a mobile bundle. Call the API from a server; to build something inside Tylode, write a plugin.
• Use one token per integration. If one leaks or you stop using a tool, you revoke that token without breaking the others.
• Review the list now and then. Revoke tokens you don't recognize or haven't used for a long time.
• If a token leaks, revoke it straight away and create a new one.
• Building for other people? Use OAuth. Never ask other users for their personal token.

#OAuth tokens

Apps registered with OAuth get tokens that start with tylode_oat_. You send them in the same Authorization: Bearer header, but they can only call the endpoints covered by the permissions the user granted (databases included, with databases:read and databases:write). On the MCP server, the assistant only sees the tools for those permissions. The person who authorized the app must be on Pro.

#Rate limits

The API allows 60 requests per minute per user.

• The count is per person, not per token. All your tokens, the MCP server, the OAuth apps you've authorized and the plugins you use share the same 60.
• The minute is the clock minute: the counter starts again at second 0 of every minute.
• Requests over the limit also count, so hammering the API while blocked doesn't help.
• Each MCP tool call counts as 1 request (list_cards counts as 2), so an assistant can make about 60 tool calls a minute. Connecting and listing tools have their own separate limit. See MCP server.
• The OAuth token endpoint has its own limit of 30 requests per minute per IP address.

When you go over the limit, you get a 429 status:

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60
X-RateLimit-Limit: 60

{ "error": "…" }

Retry-After tells you the most seconds to wait and X-RateLimit-Limit the per-minute limit. Wait until the next minute starts and retry, adding a little backoff if it happens again. A 429 means nothing was done, so it's safe to repeat any request that got one, including POST.

async function tylode(path, init = {}, attempt = 0) {
  const res = await fetch(`https://app.tylode.com/api/v1${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${process.env.TYLODE_TOKEN}`,
      "Content-Type": "application/json",
      ...init.headers,
    },
  });

  if (res.status === 429 && attempt < 3) {
    // Wait for the next clock minute, plus a growing, slightly random margin.
    const untilNextMinute = 60_000 - (Date.now() % 60_000);
    const backoff = attempt * 2_000 + Math.random() * 1_000;
    await new Promise((resolve) => setTimeout(resolve, untilNextMinute + backoff));
    return tylode(path, init, attempt + 1);
  }

  const json = await res.json();
  if (!res.ok) throw new Error(`${res.status}: ${json.error}`);
  return json.data;
}

#Authentication errors

Both return the usual error body. The message is human-readable and can change, so check the status code, not the text:

curl -i https://app.tylode.com/api/v1/workspaces \
  -H "Authorization: Bearer tylode_pat_wrong"

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{ "error": "…" }

More status codes in Errors and conventions.

#Related pages

• Developer platform: quickstart and endpoint index.
• OAuth 2.0 apps: access on behalf of other users.
• Account security: protect the account behind your tokens.