--- title: "Ticket Fairy API Authentication | Tokens, OAuth and Agent Approval" description: "Create a Personal Access Token, let an AI agent ask for your approval, or use OAuth with PKCE. What each credential can reach, and how to end access." canonical: "https://www.ticketfairy.com/developers/authentication" --- Ticket Fairy developer documentation # Get a credential for your script or agent A person owns every Ticket Fairy account and decides who can act for them. Create a token for your own scripts, or let an AI agent ask for your approval. Either way, the credential can do only what your team role allows. [Create a token](#tokens) [Read auth.md](https://www.ticketfairy.com/auth.md) Every organizer request ``` $ curl 'https://www.theticketfairy.com/api/events/EVENT_ID/relationships/performance?section=sales' \ -H 'Authorization: Bearer YOUR_TOKEN' \ -H 'Accept: application/vnd.api+json' ``` Send the Accept header too. Without it, some addresses answer 400. ## What needs a credential | What you want to do | Credential | How you get it | | --- | --- | --- | | Search events, read the guides, ask questions | No credential | The event API, NLWeb, Agent2Agent and the hosted MCP servers are open to everyone. | | Buy tickets for a person | A buyer key, or a signed agent profile | An ACP agent registers itself and gets its own key at once. A UCP agent signs each request with a key from its own profile. See the agent checkout documentation. | | Your own scripts and reports | A Personal Access Token | You create it in your account and keep it in your script's secret store. | | Connect an AI assistant to your dashboard | A sign-in you approve in the browser | Add the hosted organizer MCP server to the assistant, then sign in to Ticket Fairy and approve its access. | | An AI agent that acts for you | A token you approve | The agent asks for access, and you approve it in your dashboard with a six-digit code. | | A platform that signs up new organizers | An application credential | Ticket Fairy issues it to the platform. The platform starts each signup, and the person finishes it in their browser. | | An assistant on your own computer | The Ticket Fairy CLI sign-in | ticketfairy login opens your browser, and the CLI keeps the token in your system keychain. | ## Personal Access Tokens For your own scripts, reports and automations. 1. Open [your account settings](https://manage.ticketfairy.com/account) and go to the Personal Access Tokens section. 2. Enter a name for the token, then create it. 3. Copy the token. It is shown once. 4. Store it in your script's environment or secret store, for example as `TICKET_FAIRY_API_KEY`. You can also create one from the command line with `ticketfairy auth tokens create "Reporting script"`. Send it as `Authorization: Bearer` to the organizer API at `https://www.theticketfairy.com/api/`. ### Rotate or revoke a token `GET https://www.theticketfairy.com/api/user/personal-access-tokens` lists your tokens. `POST .../{token_id}/rotate` issues a new token and keeps the old one working for up to seven days by default, or until its own expiry if that comes first, so you can update your script without downtime. `DELETE .../{token_id}` revokes one at once. A Personal Access Token cannot create another token. ## Let an AI agent ask for your approval An agent that knows your email address can ask for access from anywhere, including a hosted service with no browser. Nothing is granted until you enter its code. 1. ### The agent asks for access It sends your email address and the name you know it by. Agent ``` $ curl -X POST 'https://www.theticketfairy.com/api/agent/identity' \ -H 'Content-Type: application/json' \ -d '{"type": "service_auth", "login_hint": "person@example.com", "agent_name": "Acme Assistant"}' ``` 2. ### You approve it The agent sends you a link and a six-digit code. Open the link, sign in to Ticket Fairy, check the agent's name and enter the code. The code goes into the page, never back to the agent. 3. ### The agent collects its token While it waits, the agent polls the token endpoint and gets `authorization_pending`. After you approve, it gets an access token and a refresh token. The request expires after 30 minutes. Agent ``` $ curl -X POST 'https://www.theticketfairy.com/api/oauth/access_token' \ -d 'grant_type=urn:workos:agent-auth:grant-type:claim' \ -d 'claim_token=clm_...' ``` [auth.md](https://www.ticketfairy.com/auth.md) lists every request and response field for agents, and the `connect-organiser-account` skill on the [AI agents page](https://www.ticketfairy.com/developers/ai-agents#skills) teaches an agent the same steps. ## OAuth for applications An application that Ticket Fairy registered for you uses the authorization code flow with PKCE (S256). The person signs in and approves at `https://www.ticketfairy.com/oauth/authorize`, and the application exchanges the code at the token endpoint. Each host publishes its metadata: - - - - The `profile` scope acts with the person's full dashboard permissions. The metadata also lists `agentic-organiser` and `agentic-ticket-commerce`, the grants of application credentials, and names the registration method for agent applications. A token from either token endpoint works on both APIs. The hosted organizer MCP server uses this flow with a Client ID Metadata Document, so an assistant connects with no registration step. To register any other application, email [support@theticketfairy.com](mailto:support@theticketfairy.com). On the person's own computer, the [Ticket Fairy CLI](https://www.ticketfairy.com/cli) already does this for you with `ticketfairy login`. ## Application credentials for agent platforms For a platform whose agents sign up new organizers or sell tickets for many buyers. Ticket Fairy issues an application credential to the platform. It starts with `agc_` and carries one grant: `agentic-organiser` to start organizer signups, or `agentic-ticket-commerce` to sell tickets. It is shown once, has a fixed expiry, and is bound to one tenant. A replacement credential ends the old one at once. A single shopping agent can also get an `agentic-ticket-commerce` buyer key for itself, as the [agent checkout documentation](https://www.ticketfairy.com/developers/agent-checkout#register) shows. An application credential names the platform, not a person. Every action for an organizer still needs that person's own approval in their browser. Your agent can also sign its requests with Web Bot Auth, so Ticket Fairy knows which agent sent them. The [AI agents documentation](https://www.ticketfairy.com/developers/ai-agents#signed-requests) explains how. ## Check and end access ### Who a token acts for `GET https://www.ticketfairy.com/api/v1/agent/identity` with the token returns the account it acts for. A request with no token or an expired one gets 401 with a `WWW-Authenticate` header that names the protected resource metadata. ### End a session `GET https://www.theticketfairy.com/api/oauth/sessions` lists the sessions on an account, with the agent sessions marked. `DELETE https://www.theticketfairy.com/api/oauth/sessions/{session_id}` ends one. An agent should remove only its own session: the list also shows the person's other applications. ## Errors | Answer | What to do | | --- | --- | | `authorization_pending` | The person has not approved yet. Wait the number of seconds in interval, then poll again. | | `expired_token` | The 30-minute approval window closed. Ask for access again. | | `401` | The token expired or was revoked. Refresh it with the refresh token, or ask the person again. The WWW-Authenticate header names the protected resource metadata. | | `403` | The person's team role does not allow this. Tell them. Do not retry. | | `422 no_dashboard_access` | The account has no organizer access. The person needs to start organizing events first. | | `429` | Too many requests. Wait for the number of seconds in Retry-After. | ## Questions about credentials ### What can a token do? Exactly what the person can do in the dashboard. Their team roles decide which brands and events it reaches. A token has no separate list of permissions, so create it from an account whose role fits the job, such as a team member with access to one brand. ### Can an agent create an organizer account? An agent can start it, and the person finishes it. An agent platform with an application credential starts the signup, and can prepare the brand and a first draft event. The person signs in, accepts the legal terms and chooses how to get paid in their own browser. The agent never sees their payout details, and it cannot buy a plan for them. ### Should I paste a token into a chat with an AI assistant? No. A token in a conversation stays in its history. Store it in an environment variable or a secret store, or let the agent ask for your approval instead. ### How do I stop an agent from acting for me? End its session. List your sessions, find the agent by the name it gave, and remove that session. A Personal Access Token is revoked the same way from its own list. Ticket Fairy in full: [event ticketing platform](https://www.ticketfairy.com/event-ticketing/), with the features, pricing and support behind this page. ## Further Reading [**Organizer API** Create events, read sales and copy an event's setup.](https://www.ticketfairy.com/developers/organiser-api) [**AI agents** MCP servers, Agent2Agent, WebMCP, agent skills and discovery files.](https://www.ticketfairy.com/developers/ai-agents) [**Ticket Fairy CLI** Manage events from the terminal or a script.](https://www.ticketfairy.com/cli) ## Ready to make your first request? The organizer API documentation shows each operation with an example. The agent checkout documentation shows how a shopping agent gets its own key. [Read the organizer API](https://www.ticketfairy.com/developers/organiser-api) [Read agent checkout](https://www.ticketfairy.com/developers/agent-checkout) --- This page is on Ticket Fairy, a ticketing, marketing and operations platform for live events and the venues that host them: festivals, club nights, concerts, conferences and tours, and night clubs, beach clubs and concert venues. It grows revenue with fan rewards that turn an audience into a sales channel, and runs the money side with payments and payouts, Vault business banking, and working capital advanced against ticket sales. [How Ticket Fairy ticketing works](https://www.ticketfairy.com/event-ticketing) ยท [Ticket Fairy for AI assistants](https://www.ticketfairy.com/llms.txt)