TraqLinkr API

All data endpoints use Bearer token authentication. Generate an API key from your Account page, then include it in every request:

curl -H "Authorization: Bearer tql_live_YOUR_KEY" \
  https://traqlinkr.io/api/v1/projects

API keys start with tql_live_ and are shown once at creation. Keep them secret.

For POST requests that create resources, include an Idempotency-Key header to safely retry without creating duplicates:

curl -H "Authorization: Bearer tql_live_..." \
  -H "Idempotency-Key: my-unique-request-id" \
  -d '{"name": "My Project"}' \
  https://traqlinkr.io/api/v1/projects

• • If the same key is sent again, you'll get the original response with an Idempotent-Replayed: true header
• • Keys expire after 24 hours
• • Supported on: POST /api/v1/projects and POST /api/v1/batch

Every webhook delivery includes an X-TraqLinkr-Signature header for verification. The format is t=timestamp,v1=hmac.

// Node.js verification example
const crypto = require('crypto');

function verify(payload, signature, secret) {
  const [tPart, vPart] = signature.split(',');
  const timestamp = tPart.split('=')[1];
  const expected = crypto
    .createHmac('sha256', secret)
    .update(timestamp + '.' + payload)
    .digest('hex');
  return vPart.split('=')[1] === expected;
}

• • Events: project.created, track.created, step.updated, share.created, share.revoked
• • Retries: 3 attempts with exponential back-off (0s, 5s, 30s)
• • Timeout: 10 seconds per delivery attempt