Skip to main content
POST
cURL
Guide: Connected apps

Authorizations

Authorization
string
header
required

Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), notifications:templates (includes notifications:read), chat:menus, chat:attendant. No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. Nor chat:menus: the five conversation menu operations answer such a key 403 insufficient_scope, and a connected app's key holds it once the client approved it. Nor chat:attendant: the five auto-attendant operations answer such a key 403 insufficient_scope too, and a connected app's key holds it once the client approved it. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.

Headers

Idempotency-Key
string

A 1 to 128 printable-ASCII-character key you generate, scoped to your API key. Replaying it with the same request answers the original 2xx unchanged, with the response header Idempotent-Replayed: true, and runs nothing again; the same key with another request answers 409 idempotency_key_reused, and a request still in flight 409 idempotency_in_progress. A refused request is never stored, so a corrected retry under the same key runs. Keys expire after 24 hours.

Body

application/json
title
string
required

The name your client's team sees on the tab: 2 to 30 characters, unique among the menus that show in the application's conversations. Refused: required, length, taken.

url
string
required

The link of the page, saved as sent: https:// only, at most 1024 characters, on a public domain name (no IP address, no port but 443, no user name or password, no token in the host). It may hold the tokens {customer_phone}, {customer_name}, {customer_email} and {conversation_id}, filled when the menu opens, and the key you made for this one client. Refused: required, http, host, length, reserved.

icon

site by default: "site" takes the link's site's own icon (its favicon or apple-touch-icon), as the console does; "none" shows no icon; { "url": "https://..." } is an https link to a PNG, JPEG or WebP of at most 1 MB and at least 32 px on its short side, which Tawked downloads once from a public address and turns into the 64 px icon Tawked Chat shows. Refused: type (not a PNG, JPEG or WebP of at most 1 MB, or an icon of another shape), small (under 32 px), unreachable (the link could not be read).

Response

Added

id
string
title
string
url
string
icon_url
string
frame
string
created_at
string<date-time>
updated_at
string<date-time>