Ory Talos API
Ory Talos is a high-performance API key management service. It handles the full API key lifecycle: issuing keys, verifying them at low latency, deriving short-lived tokens (JWT and Macaroon), and revoking access.
Authentication
Admin*-prefixed RPCs require admin authentication: send a bearer token in the Authorization header. Talos does not bundle an identity provider for the admin surface, so deploy it behind your own authentication and authorization. The self-service RevokeApiKey RPC is the exception: it authenticates by proof of possession (the caller supplies the raw credential secret) and needs no admin token.
API surfaces
Talos is a single binary with three deployment modes: admin (the full lifecycle and verification surface), self-service (only proof-of-possession self-revocation for credential holders), and all-in-one (both surfaces in one process). Run the admin and self-service surfaces separately to keep the privileged API off the public network.
Requests and responses
The API speaks JSON over HTTP. All paths are versioned under /v2alpha1/. Errors use the standard google.rpc.Status shape with a numeric code, a human-readable message, and a details array for machine-readable context.
Versioning and stability
This is v2alpha1. While the API is in alpha, request and response shapes may change without notice. Pin to a specific build and review the release notes before upgrading.
