docs(api): recommend API keys over user access tokens - #149
Closed
yacinekahlerras-turbodocx wants to merge 1 commit into
Closed
docs(api): recommend API keys over user access tokens#149yacinekahlerras-turbodocx wants to merge 1 commit into
yacinekahlerras-turbodocx wants to merge 1 commit into
Conversation
The Authentication section still said "TurboDocx is working on it's API Key flows, and for the time being, we recommend grabbing the access token used from your user's accounts". API keys have shipped and are what every SDK guide already uses, so the page was steering integrators onto the fragile path: a user access token is tied to a signed-in session and expires, which breaks unattended backend jobs. Document both credentials, say plainly which one to reach for, and add the same distinction to the SDK "Get Your Credentials" section that the other SDK pages link to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
yacinekahlerras-turbodocx
marked this pull request as ready for review
August 18, 2026 15:27
Member
|
Closing this until further discussion @yacinekahlerras-turbodocx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The API reference's Authentication section still read:
API keys have shipped, and every SDK guide in these docs already authenticates with
TURBODOCX_API_KEY. So the API reference was steering integrators onto the more fragile of the two credentials: a user access token is scoped to a signed-in session and expires, which is exactly the wrong fit for the unattended server-side jobs most people build against this API.What changed
docs/API/turbodocx-api-documentation.info.mdx— rewrote Authentication to document both credentials, recommend the API key for server-to-server use, and describe the user access token as the session-scoped alternative. Also broadened the 401 line to mention an expired credential, since that's the common failure with a user token.docs/SDKs/index.md— added anapiKeyvsaccessTokennote under Get Your Credentials. Several SDK pages (deliverable-php,deliverable-javascript,quote-javascript,deliverable-java) offeraccessTokenas an alternative without saying how it differs, and they all link back to this section.Notes
npm run buildpasses. The two broken-anchor warnings it prints are pre-existing inpartner-javascript/partner-php(#orguserrole-organization-users) and unrelated to this change.AGENTS.md(low-risk docs correction), so the merged PR is the record and no Change Request issue was filed.🤖 Generated with Claude Code