Tallyfy Authentication

generated: '2026-07-21'
method: searched
source: https://raw.githubusercontent.com/tallyfy/cli/HEAD/pkg/tallyfy/client.go
docs: https://tallyfy.com/products/pro/integrations/open-api/
summary:
  types: [http, oauth2]
  http_scheme: bearer
  transport_header: 'Authorization: Bearer {access_token}'
  oauth2_flows: [implicit]
schemes:
  - name: personalAccessToken
    type: http
    scheme: bearer
    description: >-
      User (personal) access token tied to a specific user and their exact
      permissions, obtained from the user profile. Sent as Authorization: Bearer.
      Invalidated when the user logs out of the Tallyfy web app - not recommended
      for long-running automations.
  - name: applicationToken
    type: http
    scheme: bearer
    description: >-
      Application-level credentials (client ID and secret) that let an application
      act on behalf of multiple users. Ideal for server-to-server connections and
      long-running automations.
  - name: oauth2
    type: oauth2
    flow: implicit
    authorizationUrl: https://account.tallyfy.com/oauth/authorize
    response_type: token
    token_delivery: url-fragment   # access_token returned in the redirect URL fragment
    description: >-
      OAuth 2.0 implicit grant for third-party applications. Users authenticate on
      Tallyfy's domain; the access token is returned in the redirect URL fragment
      (token_type=Bearer, expires_in). Available to paid organizations; Client ID
      is issued by Tallyfy Support. No granular scope surface is documented - the
      token acts with the authenticating user's permissions.
notes:
  - Most endpoints are organization-scoped (/organizations/{org_id}/...); a token is tied to the user's current organization.
  - No public OpenAPI/Swagger document is served unauthenticated (api.tallyfy.com/openapi.json returns 401); auth model captured from first-party CLI source and docs.