Introduction to the Tentary API

The API has the same functions that connected AI apps such as ChatGPT or Claude use through the Tentary MCP server (https://mcp.tentary.com/mcp). To connect an AI app, see Connect AI apps to Tentary. This reference is for developers who work with the API directly.

Base URL

All requests go to:

https://api.tentary.com

All paths start with /v1.

API keys

The API accepts only API keys, not the sign-in tokens of AI apps. You create a key in Tentary:

1. In Tentary, open the page AI & API.
2. Click New API key and give the key a name, for example “My export script”.
3. Under The key may:, choose the permissions. All are selected by default.
4. Click Create key and copy the key at once. Tentary shows it this one time only.

A key starts with tnt_. Send it with every request in the Authorization header:

curl https://api.tentary.com/v1/account -H "Authorization: Bearer YOUR_API_KEY"

The examples in this reference read the key from the environment variable TENTARY_API_KEY. This is how you set it in the terminal:

export TENTARY_API_KEY="tnt_..."

Important: A key can read and change your data. Keep it secret and do not put it into code that other people see.

Good to know:

• Only the account owner sees the page AI & API and can create keys.
• You can have at most 10 active keys and create at most 20 new keys per day.
• Tentary stores only a hash of the key. If you lose it, create a new one.
• For each new key you get the email “New API key for your Tentary account”.
• A key does not expire by itself. It works until you revoke it with Revoke, or until you change your password or your login email address. After that you need a new key.

Permissions

Each key has one or more permissions. If one is missing, the API answers with the error scope_missing and the status 403.

Permission	In Tentary	What it allows
read	Read data	All reading endpoints, and feedback to Tentary
catalog:write	Edit catalog	Change products, files and images, courses, modules, lessons, coupons, HTML landing pages and legal texts; archive or delete them (with confirmation)
customers:write	Edit customers	Give and remove access, reactivate customers, deactivate external customers (with confirmation)
email:write	Write emails	Campaign drafts, automations and their emails, test emails; send, activate, deactivate and delete (with confirmation)
orders:write	Manage orders	Refund orders, stop subscriptions and installment plans (both with confirmation)

A write permission does not include read. Without read, a key can change things but cannot look them up.

Requests and answers

• GET reads data. POST and PATCH take a JSON body (Content-Type: application/json) and usually need a key with a write permission. POST /v1/feedback needs only the read permission.
• PATCH changes only the fields that you send. A field that you leave out stays as it is. null removes a value where the endpoint allows it.
• Lists are newest first and come in pages. See Pagination.
• Amounts are decimal strings, for example "19.90", always with a currency like EUR.
• Times are in UTC, for example 2026-01-31T14:05:00Z. Days look like 2026-01-31.
• Some actions such as refunds, sending and deleting change nothing at once. They first need a confirmation in Tentary. See Confirmations.
• Errors always have the same format. See Errors.

Example data

The example requests and answers come from “Lena Berg Yoga”, the demo shop of a yoga teacher. Names, email addresses and IDs are invented.

Control and log

Every change through the API shows in the Activity log as “API key: name of your key”. Tentary logs each call for 90 days, with the time, the key or app, the tool and the result, but without content.