Docs › Authentication & keys

Authentication & keys

Every call carries a ck_ key in the Authorization header. Here’s how to get one, add more, cap them and keep them safe.

Get a key

The easiest way is the Get API key page. Under the hood it calls:

POST/v1/account/anonymousno key

curl

curl -X POST https://api.tokenctr.com/v1/account/anonymous

JSON

{
  "api_key": "ck_…",
  "key": "ck_…",
  "account": "h:…",
  "credits_face_usd": 0.0,
  "shown_once": true
}

No email, password or card. Each call creates a new account with its own key and a $0 balance.
The key is shown once. We store only a fingerprint (hash), so we can’t recover a lost key.
Up to 3 new keys per IP address per day. Over the limit you get 429 anonymous_ip_limit (or anonymous_daily_cap when the site-wide daily limit is reached), with Retry-After: 3600.

Keep your key safe

Credit belongs to the account behind the key. If you lose every key for an account, that balance can’t be reached. Add a second key as a backup (see below) and keep both in a password manager.

Sending your key

Put the key in the Authorization header with the word Bearer, a capital B and one space:

HTTP header

Authorization: Bearer ck_your_key_here

OpenAI SDKs do this for you when you pass the key as api_key / apiKey. A missing, malformed, unknown or revoked key gets 401 bad_key.

Only POST /v1/account/anonymous, GET /v1/founding/status and GET /healthz work without a key. Everything else, including GET /v1/models, needs one.

More keys, caps and rotation

One account can hold several keys, for example one per app or teammate. All keys share the account’s balance. Each call below must be made with an existing key for that account.

Endpoint	Body	Result
`POST /v1/keys/issue`	`{"label": "ci-bot", "daily_cap_usd": 2}` (both optional)	`{"key": "ck_…", "shown_once": true}`
`POST /v1/keys/revoke`	`{"key_hash": "…"}`	`{"revoked": true}`
`POST /v1/keys/rotate`	`{"key_hash": "…", "label": "…", "daily_cap_usd": …}`	Issues a new key, then revokes the old one. Returns the new key once.
`POST /v1/keys/cap`	`{"key_hash": "…", "daily_cap_usd": 5}` (`null` removes the cap)	`{"ok": true, …}`

key_hash can be the full key (ck_…) or the fingerprint shown in GET /v1/account (for example daf927a26ebd...). Careful: revoking the key you’re calling with locks that key out immediately.

curl

curl -X POST https://api.tokenctr.com/v1/keys/issue \
  -H "Authorization: Bearer $TOKENCENTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label": "backup"}'

Daily spending caps

A key with daily_cap_usd stops working for the rest of the UTC day once it has spent that much, with 429 key_cap_exhausted. Caps reset at 00:00 UTC. Use them to limit what a single app or a leaked key can spend.

Keeping keys safe

Keep keys on your server, in environment variables or a secrets manager. Don’t ship a funded key in a web page or mobile app.
Never commit a key to git. If one leaks, rotate it right away with POST /v1/keys/rotate.
Give each app its own key with a daily cap, so one problem can’t drain your whole balance.