Authentication

Tariq supports two credential types: API keys for server-to-server calls and JWT bearer tokens for dashboard sessions. All authenticated requests use the Authorization header.

API keys

Pass your key as a Bearer token. Test keys operate in the test environment; live keys in live. Keys are scoped to your organization.

curl https://api.tariqmap.com/v1/locations \
  -H "Authorization: Bearer tq_test_..."

Session tokens

User sessions from signup/login return a short-lived access token and refresh token.

POST https://api.tariqmap.com/v1/auth/login
{
  "email": "you@company.com",
  "password": "your-password"
}

// Response
{
  "success": true,
  "access_token": "eyJ...",
  "refresh_token": "rt_...",
  "user": { "id": "usr_...", "email": "you@company.com" }
}

Public endpoints

Some resources, such as public maps, do not require authentication. Health checks at GET /v1/health are also public.

Errors