API keys

Create, reveal, disable, and revoke Tokener.ai API keys.

Updated 2026-10-20
Edit on GitHub

Tokener.ai API keys authenticate requests to https://api.tokener.ai/v1. Keys belong to your organization and spend against its prepaid credit balance.

Organization access

Owners and admins can list and manage every user-created key in the organization. Members can list and manage only keys they created. Every role can create its own key.

Create a key

  1. Open API keys in the console.
  2. Name the key for an app or environment (for example prod-web).
  3. Create the key and copy the secret.

Creation waits for up to 30 seconds. If the console reports that the result is unknown, close the dialog and check the key list before creating another key. The request may still succeed; the console does not retry it automatically.

Tokener stores the key encrypted so you can reveal it again until it is revoked. Revocation permanently deletes the stored secret.

Use a key

Send the secret as a Bearer token:

HTTP
Authorization: Bearer sk-...

Disable or revoke

Disable a key to stop traffic without deleting the record. Revoke when the secret may be exposed. Disabled and revoked keys are rejected by the gateway.

Best practices

  • One key per app or environment
  • Rotate on a schedule and after staff changes
  • Never commit keys to git or ship them to browsers