Authentication
Base URL, authorization header and API key handling.
Every request is authenticated with an API key sent in the Authorization header.
Base URL
| Item | Value |
|---|---|
| Base URL | https://www.tokenmoo.com |
| API prefix | /v1 |
| Chat endpoint | POST https://www.tokenmoo.com/v1/chat/completions |
| Auth header | Authorization: Bearer sk-... |
Header
Authorization: Bearer sk-xxx
Content-Type: application/jsonThe key is per-user and can be revoked at any time from API Keys in the console. Revocation takes effect immediately.
Key management
- Create one key per application so you can rotate or revoke it independently.
- Keys are shown only once when created; store them in a secret manager or environment variable.
- Use a separate key for testing so production traffic is easy to isolate.
Keep your key secret. Never commit it to a repository or paste it into third-party tools — anyone who holds the key can spend your balance.
Common mistakes
| Symptom | Cause |
|---|---|
401 Missing or invalid API key | Header missing, malformed, or the key was deleted |
403 Model not permitted | The model is not enabled for your account or group |
| Requests succeed but cost more than expected | A different key is in use, or the request sends more tokens |