Authentication

API keys#

Create and manage keys in Dashboard → API keys. A key is shown in full exactly once at creation time — after that only the prefix and last four characters are visible.

Making authenticated requests#

Pass your key in the Authorization header of every request. Requests without a valid key return 401 authentication_error.

curl https://api.tapotik.ai/v1/models \
  -H "Authorization: Bearer $TAPOTIK_API_KEY"

import Tapotik from "@tapotik/sdk";

// Reads TAPOTIK_API_KEY from the environment by default.
export const tapotik = new Tapotik({
  apiKey: process.env.TAPOTIK_API_KEY,
});

Workspaces and projects#

Keys belong to a workspace. If your organization has multiple projects, attribute usage with the optional Tapotik-Project header — usage analytics and budgets are broken down per project.

curl https://api.tapotik.ai/v1/chat/completions \
  -H "Authorization: Bearer $TAPOTIK_API_KEY" \
  -H "Tapotik-Project: proj_support_copilot" \
  -H "Content-Type: application/json" \
  -d '{ "model": "router/auto", "messages": [...] }'

Scoped tokens for clients#

Never ship tp_live_ keys to browsers or mobile apps. Instead, mint a short-lived scoped token from your backend and hand that to the client.

import { tapotik } from "@/lib/tapotik";

export async function POST() {
  const token = await tapotik.tokens.create({
    scopes: ["chat.completions:create"],
    expires_in: 900, // seconds, max 900
    metadata: { user_id: "usr_8f2k" },
  });

  return Response.json({ token: token.value }); // "tp_scoped_..."
}

Key rotation and hygiene#

• Rotate keys from the dashboard — the old key keeps working for a configurable grace period (default 24 hours) so deploys can roll.
• Scope keys to the minimum surface: a key used only for image generation should carry only images:create.
• Set per-key monthly budgets to cap blast radius if a key leaks.
• Watch the audit log — every request records key, IP, model and credit spend.

Next: check rate limits for per-key throughput, or head back to the quickstart.