Get started

Authentication

Every request carries a TokenFactory API key as a bearer token.

API keys

Create and revoke keys in your dashboard. Keys start with tf_. Send the key in the Authorization header:

Authorization: Bearer tf_...

One key works across the API: chat completions today, and the video and realtime endpoints as they become available. A revoked key stops working immediately. Keys are stored as a SHA-256 hash, so we cannot show you a key again after it is created.

What a key can see

Jobs and sessions belong to the key that created them. Reading, downloading, ending, or connecting to another key's job or session returns 404, the same as one that does not exist.

Authentication errors

StatusMeaning
401Missing, malformed, or revoked key.
404The job or session does not exist, or belongs to a different key.
chat API error body
{ "error": { "message": "Invalid API key", "type": "authentication_error", "code": "invalid_api_key" } }

Keeping keys safe

  • Never put a key in client-side code, a URL, or a log line.
  • Use one key per environment so you can revoke one without touching the others.
  • Call the API from your server and hand end users only the results.
← QuickstartJobs →