Tagify

Authentication

Know which auth model you are calling—session for most live handlers, planned key headers for /api/v1.

Session auth (current)

Dashboard and many /api/*.php handlers rely on PHP session cookies after login, sometimes with CSRF protections for business AJAX.

The draft /api/v1 contract describes X-Tagify-Key and X-Tagify-Secret headers for programmatic access when that surface ships.

Do not embed owner passwords in devices. Use admin-confirmed device pairing for entry hardware and contact Tagify for partner integrations.

Today Tagify exposes many PHP handlers under /api/ for authenticated business and check-in flows. A public /api/v1 JSON REST contract is planned.

Optional paired devices for desks and kiosks when phones alone are not enough for your traffic pattern.

A short path from signup to first successful check-in.