Connect Tare7 to the rest of your operation.

Every API request needs a bearer token. Generate a key at Settings → Integrations → Developer API (owners + admins only). Keys start with t7_ and are shown once at creation time — store them like a password.

curl -H "Authorization: Bearer $TARE7_KEY" \
  https://tare7.com/api/v1/on-hand?location_id=loc_...

Keys are org-scoped. Every request is checked against the configured scopes for that key — a key with items.read alone cannot list purchase orders. Revoke a key at any time from the same page.

All responses are JSON. Errors follow { "error": string, "detail": string? } with the appropriate HTTP status.

List endpoints accept limit (default 50, max 200) and offset. A limit above 200 is clamped rather than rejected.

Each API key may make 60 requests per minute. The window is a fixed clock minute, not a rolling one — the counter resets at the top of each minute, so a burst spanning a minute boundary can send up to 60 on each side of it.

Every response to /api/v1 carries:

• X-RateLimit-Limit — requests allowed per minute (60).
• X-RateLimit-Remaining — requests left in the current minute.
• X-RateLimit-Reset — unix seconds at which the current window resets.

Exceeding the limit returns 429 Too Many Requests with a Retry-After header in whole seconds and the usual error body:

HTTP/1.1 429 Too Many Requests
Retry-After: 37
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1799999940

{
  "error": "Rate limit exceeded",
  "detail": "Limit is 60 requests per minute per API key. Retry in 37s."
}

Limits are counted per key, not per org — issue separate keys for separate integrations so one does not starve another. Need a higher ceiling? Email support@tare7.com.

Register a delivery URL at Settings → Integrations → Developer API. Choose which events fire to that URL. Every request:

• POST with a JSON body describing the event.
• Signed with your endpoint's shared secret using HMAC-SHA256. Signature is in the X-Tare7-Signature header.
• Retried on non-2xx responses with exponential backoff, up to 3 attempts.
• SSRF-guarded — private-network URLs and non-HTTPS endpoints are rejected before delivery.

Verifying a signature in Node:

import crypto from "node:crypto";

function verify(body: string, header: string, secret: string) {
  const [tsPart, sigPart] = header.split(",");
  const timestamp = tsPart.replace("t=", "");
  const signature = sigPart.replace("v1=", "");
  const payload = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex"),
  );
}