Tmx Group Authentication

generated: '2026-07-22'
method: searched
source: https://docs.tmxanalytics.com/#steps-to-access-apis
docs: https://docs.tmxanalytics.com/#steps-to-access-apis
summary:
  types: [apiKey, http-bearer]
  api_key_in: [header]
  notes: Dual-credential model - every request to the Data Science APIs (V1 and V2)
    requires both a fixed per-client x-api-key header (generated in the TMX Analytics
    Hub) and a short-lived bearer token obtained by POSTing username/password to the
    Authenticate endpoint. Not OAuth 2.0; a proprietary token endpoint.
schemes:
  - name: x-api-key
    type: apiKey
    in: header
    parameter: x-api-key
    description: Generated post-activation from hub.tmxanalytics.com (API Usage tab,
      re-enter password to reveal). The key remains fixed for each client.
  - name: bearerAuth
    type: http
    scheme: bearer
    description: API Authorization token generated by POST /v1/authn
      (https://analyticsapi.tmxanalytics.com/v1/authn) with registered email and
      password. Tokens are valid for one hour and must be refreshed; a RefreshToken
      schema and a Revoke Token endpoint (POST /v1/revoke) are documented. V2
      (insightapi.tmxanalytics.com) authenticates with the same hub-issued API key
      and bearer token as V1.
account_lifecycle:
  register: Sign up at hub.tmxanalytics.com or contact datasupport@tmx.com; activation
    link arrives by email from datasupport@tmx.com and the user sets a password.
  change_password: POST /v1/changepassword, via hub.tmxanalytics.com menu, or via
    datasupport@tmx.com.
  forgot_password: POST /v1/forgotpassword
  revoke_token: POST /v1/revoke
guidance:
  - Treat tokens as highly confidential and store them securely.
  - Tokens are valid for one hour only.
  - Monitor API usage for anomalies and rotate the API Authorization token on any
    suspicious activity.