Docs
Authentication
Every API request authenticates with a bearer key. Keys belong to your account, not to a model: one key calls the whole catalog.
API keys
- Created on the API keys page. The full key starts with
tk_and is shown exactly once, at creation. - We store only a SHA-256 hash. A lost key cannot be recovered, only replaced.
- Each key can carry its own monthly spend cap, set at creation or later. A capped key that hits its limit returns
429 monthly_key_limit_exceededwhile the rest of your account keeps working.
The header
Send the key in the standard header on every request:
Authorization: Bearer tk_...
A missing, malformed, or revoked key gets:
{
"error": {
"message": "Invalid API key",
"type": "invalid_request_error",
"code": "invalid_api_key"
}
}Browser apps
The API sends CORS headers on every /api/v1 route, so requests from web pages work out of the box, preflights included:
// Works from any origin: the API sends CORS headers on /api/v1/*.
const response = await fetch("https://tokenkiln.com/api/v1/chat/completions", {
method: "POST",
headers: {
"Authorization": "Bearer tk_...",
"Content-Type": "application/json",
},
body: JSON.stringify({
model: "Qwen/Qwen2.5-7B-Instruct",
messages: [{ role: "user", content: "Hello from the browser!" }],
}),
});
const data = await response.json();
console.log(data.choices[0].message.content);A key shipped to a public website can be read by anyone who opens devtools. For anything public, keep the key on your server and proxy the call. If you accept the trade for a prototype or an internal tool, give that key a monthly spend cap so the worst case is bounded, and revoke it the moment it leaks.
Rotation and revocation
Revocation is immediate: the next request with a revoked key gets a 401. To rotate, create the new key first, deploy it, then revoke the old one. Keys are cheap, so give each app its own; the Activity page breaks usage down per key, which makes a leak or a runaway job easy to spot.