Get an API key from code
TL;DR — Run one command, paste a 6-digit code from your inbox, get an API key. No browser, no dashboard, no copy-pasting.
TAGADA_API_KEY, TAGADA_STORE_ID, and TAGADA_ACCOUNT_ID into the .env of the directory you’re in.
Why this exists. AI coding tools (Claude, Cursor, Lovable, v0…) are great at writing storefront code, but they can’t click through a signup form. So we exposed the same flow as a CLI command and a public SDK call — both end with a working API key in your hands.
Pick your path
All three end with the same thing: a UUID-shaped API key that works against
https://api.tagada.io.
Path 1 — The CLI (interactive)
1
The CLI calls /api/public/onboarding/start
A 6-digit code lands in
you@example.com within a few seconds. The email subject is “Verify your TagadaPay account” — the code is only inside the body, never in the subject or lock-screen preview.2
You paste the code
The CLI prompts you. Type the 6 digits, hit enter.
3
The CLI calls /api/public/onboarding/verify
On success it gets back an It also writes framework-specific mirrors when relevant:
apiKey, storeId, and accountId, and writes them to .env in the current directory:4
A demo store seeds in the background
Sandbox processor, payment flow, 2 demo products (an Essential Tee in 3 colorways and an Essential Cap), one checkout upsell, and a default shipping rate. Takes ~10 seconds. Your API key is usable immediately — the catalog populates as the seeder runs.Want a richer 6-product apparel catalog? Examples like
headless-react-store ship a scripts/seed.ts you can run with pnpm seed $TAGADA_API_KEY to extend the demo.Path 2 — The SDK (programmatic)
If you’re writing your own script (an AI agent, a CI step, an installer for your framework), call the SDK directly.Tagada.public() returns a no-auth client — its only job is to bootstrap a key for new Tagada(apiKey):
result:
Error handling
onboarding.start and onboarding.verify throw an OnboardingError with a typed code field — no string-sniffing required:
Same email twice? Both
tagada-init and Tagada.public() mint a fresh sandbox account on every successful verify. If you re-run with an email that already has an account, the call will succeed and you’ll get a brand-new account — keep track of the keys you’ve generated.Path 3 — The dashboard (existing account)
If you already have a Tagada account and just need a new key:1
Open Settings
Click your avatar (top-right) → Settings.

2
Generate the key
Go to Access Tokens → + Create Access Token. Copy the UUID.

What the API key gives you
The key minted viatagada-init / Tagada.public() has org:admin scope on the new account — it can do everything the SDK exposes:
For multi-tenant setups that mint per-merchant keys from a partner account, see the Partners tab.
Security model — quick notes
- OTP delivery: 6-digit, single-use, expires after 5 minutes. Generated with a CSPRNG (
crypto.randomInt). - Rate limits: 3 sends / 10 min / IP and 5 sends / hour / email on
start; 10 verifies / 10 min / IP onverify(fail-closed if our cache is unavailable, so brute-forcing isn’t possible during outages). - Lock-screen-safe email: the subject is
"Verify your TagadaPay account"and the lock-screen preview is"Open this email to see your verification code."— the code itself is only inside the email body. - Single-claim provisioning: even if
verifyis called twice in parallel with the same correct code, only one of the calls provisions an account — the other getsno_pending_code.
Next steps
Build a store with AI
Use Claude, Lovable, or v0 with the key you just minted.
Node SDK Quick Start
Create stores, products, and process payments from your server.
