Authentication
How to send your key, what inference and CLI keys can each do, and how per-key limits work.
Sending your key
Send the key in either header. Both are accepted on every /v1 route, so the OpenAI and Anthropic SDKs work unchanged.
Authorization: Bearer sk-token-...Keep the key out of source code: read it from an environment variable such as TOKEN_SHARE_KEY. A missing, unknown, revoked or expired key gets the same 401 invalid api key.
Key types
You choose the type when you create a key on the API Keys page. The split keeps a leaked key from doing more than its job.
| Type | Can | Cannot |
|---|---|---|
| Inference | Call models on /v1; read the cost of its own requests and its own limit via the Billing API | See the account balance or other keys’ requests; list, create or revoke keys |
| CLI | Sign in to the token CLI, create inference keys, read account usage; see every request and the account balance via the Billing API | Run inference |
Per-key limits
Every key draws on the account balance. You can also give a key its own USD limit, so one project or teammate cannot spend past it; leave it unlimited and only the account balance applies.
Auth, model and balance checks run before a request is forwarded, so a rejected request costs nothing. GET /v1/billing/balance shows how much of a key’s limit is left — see the Billing API.
Revoking a key
Revoke a key on the API Keys page. It stops working on the next request; create a new one for whatever used it.