Authentication

The API accepts an API key. A dashboard login is a separate session, and that session cannot call /v1/resolve or /v1/locations. A login lasts 6 hours.

API keys

Pass your key as a Bearer token. Test keys operate in the test environment; live keys in live. A key can expire on a date you choose, or it can stay valid until you revoke it. An expired key stops working on its own.

curl https://api.tariqmap.com/v1/locations \
  -H "Authorization: Bearer trq_test_..."

Session tokens

Signing in returns a session for the dashboard. It expires after 6 hours, and it is not an API key.

POST https://api.tariqmap.com/v1/auth/login
{
  "email": "name@email.com",
  "password": "your-password"
}

// Response
{
  "success": true,
  "access_token": "eyJ...",
  "refresh_token": "rt_...",
  "user": { "id": "usr_...", "email": "name@email.com" }
}

Public endpoints

Some resources, such as public maps, do not require authentication. Health checks at GET /v1/health are also public.

Errors