Simple access token

Building an integration just for your company?

Are you building an integration to only access your own tiny+ data?

Rather than registering an app, you can get a simple long-life access token by visiting crm.tiny.plus/account/api_access. You'll need to be an account admin to open this page.

There are two kinds of token:

• A ReadWrite token can read and change your tiny+ data.

• A ReadOnly token can only read it.

A token lasts ten years. It is shown once, when you generate it, so copy it somewhere safe straight away.

Send the token in the Authorization header of every request:

Authorization: Bearer {{user_access_token}}

Important considerations...

Treat your access token like a password. Anyone who has it can access your tiny+ account.

A couple of really important points about how to use your access token.

1. Treat your access token like a password to your tiny+ account. This means that you should NEVER include it in a public Git repository, or in the Javascript code of a website you build.

2. Only use these access tokens in server-side code. These tokens should only ever be used in server-side code, such as in a PHP script.

3. Actions performed when using our API with this access token will be in the context of your user account. It may be worthwhile creating a user account in tiny+ that belongs to the integration you are building.

4. The access token belongs to your user account, not to the tiny+ account. If you belong to more than one tiny+ account, add account={account id} to a request to choose which account it's for. Requests, responses and errors explains how.

5. The access token will stop working if your user account is disabled or deleted, or if the tiny+ account is closed. You will need another user to generate a new access token if your account is ever going to be deleted.

If you believe your access token has been compromised, you should go to crm.tiny.plus/account/api_access as soon as possible, revoke it, and generate a new one.