Two Minute Reports Logo
Try for freeLogin
API reference

Authentication

Authenticate Two Minute Reports API requests with a bearer token, and learn how to create one.

The Two Minute Reports API authenticates every request with a bearer token. The token is an API key that you create in the Hub. Send it in the Authorization header:

curl https://api.twominutereports.com/v1/users/me \
  -H "Authorization: Bearer tmrc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

The API does not use cookies or sign-in sessions. The token is the only credential.

Create an API key

Create the key with the intended use API. The REST API accepts only API keys. A key made for the MCP server does not work with the REST API.

You can create an API key in two places:

  • In the Hub, select AI tools, then the Automations tab. In the REST API section, select Create key. The section sets the intended use to API.
  • Or go to Settings › API keys and select Create key. Set Intended use to API.

If you have no keys yet, the button is Create your first key.

Configure the key

In the Create API key dialog:

  • Key name: a name that helps you find the key later, for example Weekly report script.
  • Intended use: API.
  • Expiry: when the key stops working (No expiry, 30 days, 90 days or 1 year).
  • Permissions: Full access, Minimal (the same actions for all resources) or Advanced (actions per resource). See Permissions.

Then select Create key.

Copy your key

The Hub shows the key one time. Copy it and keep it in a safe place. Then select Done.

The Hub shows the full key only one time. If you lose it, revoke the key and create a new one.

If you send a key with a different intended use, the API responds with 403 Forbidden:

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "The Two Minute Reports API accepts API keys only. Create one under Settings → API Keys with intended use \"API\"."
  }
}

For the MCP server, create an MCP key instead. See The MCP server.

Managing keys

To create, edit and revoke keys, use the Automations tab of the AI tools page, or Settings › API keys. The REST API cannot manage keys or sessions.

Permissions

By default an API key has full access: it can do anything you can. When you create or edit a key, you can restrict it to a set of scopes, written as <resource>:<action>.

  • Actions: read, write (create and update), delete. A key that can write or delete a resource can also read it.
  • Resources: account, teams, connections, connectors, clients, data, platform.

Every endpoint page lists the scope it needs as its Permission. A key is allowed if it holds that scope (or a wildcard such as clients:*, *:read, or *:*). Unrestricted (full-access) keys are unaffected.

Only these resource/action combinations exist:

Resourcereadwritedelete
accountYesYesYes
teamsYesYesYes
connectionsYesNoYes
connectorsYesYesNo
clientsYesYesYes
dataYesNoNo
platformYesNoNo
The account scope covers your profile and preferences only. You cannot manage sessions or API keys through the public API. Manage them in the Hub, in Settings › API keys.

If a key does not have the scope that an endpoint needs, the API responds with 403 Forbidden. The message names the missing scope and tells you how to grant it:

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_PERMISSIONS",
    "message": "This API key is missing the `clients:delete` permission required for this endpoint. Grant it to the key under Settings → API Keys (https://hub.twominutereports.com/settings?tab=user-api-keys), or use a key that has it."
  }
}

Token format

API keys begin with tmrc_live_, followed by 32 random characters. A key has 42 characters in total.

tmrc_live_aB3dEfGhIjKlMnOpQrStUvWxYz123456

Unauthenticated requests

A request fails with 401 Unauthorized if the Authorization header is missing or the key is not valid, has expired, or was revoked.

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or expired session"
  }
}

The message is Missing bearer token when there is no Authorization header. A key that is not valid, has expired or was revoked gets the same message, so the response does not tell if a key exists.

API reference

The Two Minute Reports REST API. Authenticate with a bearer token, then manage teams, connections and clients, and run data queries.

Rate limits

Request quotas for the Two Minute Reports API and how to handle the 429 Too Many Requests response.

Copyright © 2026