Authentication

Protected API endpoints require an API key. Keys are created in the Dashboard and stored as SHA-256 hashes. We never store the full key.

Developer login vs consumer app

Sign in on this site accesses the Dashboard (API keys, live testing, usage). It is separate from the Tanyalah Ustaz consumer app, where individuals ask questions. Accounts are not shared between the two products.

API key headers

Send your key on every API request using either header:

Authorization: Bearer tlh_live_...
# or
X-API-Key: tlh_live_...

Key format

Keys are prefixed with tlh_live_ followed by a random secret. Revoked keys return 401 Unauthorized.

Dashboard vs API auth

The dashboard uses email/password login. Your API integration uses API keys. Signing into the dashboard does not authenticate API requests, and API keys do not grant dashboard access.