API Access for Public Datasets: When You Need a Key

You have published a reviewed spreadsheet and want a script to read it—for example, to reuse a public table of monthly service counts in a newsroom graphic. API access lets software request the dataset directly instead of copying rows from the page.

For TablePage, separate two tasks: reading public data and managing data owned by your account. Public reads do not require a key; account and owner operations require authentication. The API documentation describes both anonymous and authenticated access.

Decide which access you need

As documented on October 29, 2026:

Task	Access requirement	Relevant endpoint
Read a public dataset’s metadata	No authentication	GET /api/d/{slug}/meta
Read, search or sort public rows	No authentication	GET /api/d/{slug}/query
Upload a public file through the bot API	Anonymous access supported	POST /api/bot-upload
List datasets owned by your account	API key or session cookie	GET /api/me/datasets
Edit dataset metadata	Authenticated owner	PATCH /api/d/{slug}/meta
Create, list or revoke API keys	Logged-in session cookie	/api/keys and /api/keys/{id}

These requirements appear in TablePage’s OpenAPI specification. A slug is the dataset identifier used in these paths; it is not an access credential.

An API key authenticates the caller. It does not, by itself, make published data confidential. For this public-publishing workflow, upload only material approved for unrestricted sharing—never credentials, personal records or confidential working data.

Check public access with a small read

Suppose your reviewed file has this structure. These are fictional example rows, not reported service statistics:

month,area,completed_requests
2026-09,North,124
2026-09,South,98

Start with metadata, then request only a small slice. The commands require Bash and a recent version of curl supporting --fail-with-body. Enter the actual slug of your published dataset when prompted:

read -r -p 'Dataset slug: ' SLUG
BASE='https://www.tablepage.ai'

curl --fail-with-body "$BASE/api/d/$SLUG/meta"
curl --fail-with-body --get "$BASE/api/d/$SLUG/query" \
--data-urlencode 'limit=5' \
  --data-urlencode 'page=0'

No authorization header is needed for a public dataset. The documented metadata includes headers and row count; the query response contains headers, rows and total. Pagination is zero-indexed, with a default limit of 100 and a maximum of 1,000 rows per request. See the query contract.

Before using the response downstream, check:

• Identity: the title and headers match the intended publication.
• Completeness: the metadata row count matches your reviewed export. A request limited to five rows cannot establish that a larger file arrived in full.
• Meaning: dates, area labels, units and missing values retain their intended interpretation.

For a new upload, check GET /api/d/{slug}/status until ready is true before relying on generated insights or charts. That endpoint reports processing status—not a guarantee of data accuracy. TablePage documents it in its agent workflow. In an automated script, wait between checks and set a maximum waiting time; stop and investigate errors or a timeout rather than polling indefinitely.

For the upload sequence itself, use publish and query a public dataset with TablePage.

Add a key only for an authenticated task

TablePage documents two authentication modes: a bearer API key and the tp_session session cookie. Key management requires the logged-in cookie session; an API key cannot create more keys. Authentication reference

The documented key lifecycle is:

1. From a logged-in session, send POST /api/keys, optionally with a descriptive name.
2. Store the returned raw key securely. It is returned once and cannot be retrieved later.
3. Send it in the Authorization: Bearer … header for authenticated script requests.
4. Use GET /api/keys to list key IDs and metadata, or DELETE /api/keys/{id} to revoke a key through the logged-in session.

The key-management schema documents these operations. Keep the key out of spreadsheets, public pages, shared notebooks and source control. Do not send it in a dataset URL.

Interpret access failures before changing the data

Account and key-management endpoints document 401 when required authentication is absent. The metadata endpoint documents 403 when access to a private dataset is missing or invalid, and 404 when the dataset is not found. Upload endpoints also document 429 for rate limiting. Response definitions

Check the endpoint, slug and credential requirements first. Do not repeatedly upload the same file to solve an access error, or change visibility merely to bypass one. If an established refresh stops working, follow the public dataset recovery workflow while preserving the last verified publication.