Integrations and API
API keys and the Integration API
4 min read Updated 13 Nov 2026
Contents
With Ticsie's Integration API your own system can fetch events and attendees and check in tickets – server to server. This article explains how to create a key pair, which permissions exist and what the API can do. The full reference is in the API documentation.
What can the API be used for?
- Pulling attendee lists into your own system, such as a membership register or an accreditation system.
- Building your own dashboard for your events.
- Connecting your own scanner or gate that checks in tickets via the API.
The API is designed for server-to-server calls. The keys must never be placed in an app or on a web page that visitors can see.
Create a key pair
- Open API keys. Go to Settings → API Keys. You need the Owner or Admin role.
- Name the key. Under Create New Key Pair, fill in Key Name, for example "Membership register" – so you know later what it is used for.
- Choose permissions. Tick read and/or write (see the table below).
- Generate. Click Generate Key Pair. You get a public key (starting with
ticsie_pk_) and a secret key (starting withticsie_sk_). - Save the secret key right away. Under the heading Save Your Secret Key Now the secret key is shown once only. Click Copy and store it somewhere safe, such as a password manager or an environment variable on your server.
Important
The secret key is shown only once and cannot be retrieved again – Ticsie does not store it in plain text. If you lose it, revoke the key pair and create a new one.
Permissions
| Permission | In the panel | Gives access to |
|---|---|---|
read | Read events, orders and attendees | Fetching events and attendees (GET requests). |
write | Create and modify data via API | Scanning tickets and checking in attendees (POST requests). |
Give each key as few permissions as possible. A key that only fetches attendee lists only needs read.
Requests, endpoints and limits
Every request is sent to https://ticsie.se/api/v1/integration with two headers:
X-API-Key: ticsie_pk_... X-API-Secret: ticsie_sk_...
| Endpoint | Permission | Does |
|---|---|---|
GET /events | read | Lists your events. Filter with period = future, past or all. |
GET /events/{id}/attendees | read | Lists attendees (paid tickets) for an event, 50 per page. |
POST /events/{id}/scan | write | Checks in a ticket by its UUID (the value in the ticket's QR code). |
- Rate limit: 60 requests per minute. If you exceed it, the API responds with HTTP 429 – wait and try again.
- Pagination: lists are split into pages. Fetch the next page with
?page=2. - Errors are returned as JSON with an
error_code, such asAPI_KEY_INVALIDorINSUFFICIENT_PERMISSION.
Example requests in several languages, response formats and all error codes are in the API documentation.
Revoke a key
The list under API Keys shows every key pair with its name, public key, permissions and creation date. Click Revoke and confirm with Ja, återkalla (yes, revoke). The key stops working immediately. Always revoke keys that are no longer in use or that may have ended up in the wrong hands.
Frequently asked questions
I've lost the secret key – can I see it again?
No. The secret key is only shown when the key pair is created. Revoke the old key pair and create a new one.
Why do I get the INSUFFICIENT_PERMISSION error?
The key lacks the permission the endpoint requires. Check-in via POST /events/{id}/scan requires write. Create a new key pair with the right permission.
Can I use the API key in a mobile app or on my website?
No, the keys should only be used on a server. For check-in on a phone, use the Ticsie app.
Can I create events or orders via the API?
Not at the moment. The Integration API has the three endpoints described above. Missing something? Leave a suggestion on Suggestions & roadmap.