Skip to content
Documentation
Explore guides

For integration owners

Connect an integration securely

Authenticate requests and limit access to what the integration needs. This article is for managers working with their team or management scope.

Contents

Before you start

The API allows an authorised integration to work with information in Talento. Every credential belongs to an active employee in the company: requests run with that person's permissions and within the same account.

This applies the same access control used in the application. It also makes the choice of identity, its permissions, and secure token storage part of the integration's security.

Warning

Treat an API token like a password. Never paste it into chats, tickets, documents, web addresses, or source-code repositories. Store it in the integration's secrets manager and send it only over HTTPS.

Authenticate a request with Bearer

Send the token in the HTTP Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_TOKEN

Replace YOUR_TOKEN in the integration's secure configuration. Never write the real value in examples, logs, or source code. Send requests to the company's address and the API resource documented for the operation.

The API checks three conditions before accepting a request:

  • the token is valid;
  • API access remains enabled and the employee is active;
  • the employee has permission for the requested operation.

Record errors and technical identifiers needed for support, but configure the application to redact the Authorization header and all secrets.

Troubleshoot an unauthorised response

For a 401 Unauthorized response, check in this order:

  1. The header uses the exact Bearer scheme, and the token is not sent in the URL.
  2. The configured secret is the current token, not one invalidated by rotation.
  3. API access remains enabled.
  4. The employee is active and belongs to the company making the request.
  5. The address and requested resource are correct.

If authentication succeeds but a particular operation is not allowed, review the employee's permissions. Grant only the access the integration needs; do not make its identity an administrator to solve a narrow access problem.

Result

You can verify the result in the team view or the status described in the steps above.

Common issues

If an option is unavailable, it may depend on your permissions, active modules, or company settings. Ask an administrator to review your access; you do not need to repeat the task or choose an option that does not apply.