Create and manage Tokios API keys

Every request to api.tokios.com authenticates with a Tokios API key sent as a Bearer token. You create keys on the Keys tab of the console; they start with sk-tok- and can be scoped to specific models. Keys are free and need no credit card.

Create a key

Open the Keys tab in the console.
Enter a display name (for example production-app or local-dev).
Optionally set model patterns — comma-separated globs that limit which models the key can reach (for example gemma*, gpt-4*). Leave it as * to allow all your models.
Click Create key, then copy the key immediately — it is shown only once.

A key is shown only once, at creation. Store it in a password manager or secrets vault right away. If you lose it, revoke it and create a new one.

You can hold up to 50 active keys. Each key row has actions to edit, rotate, disable, and delete it. To give a teammate or friend access without handling the secret yourself, use Share Key (next to Create key on the Keys tab). It mints a new, dedicated key for that person and emails them a one-time link to reveal it — the key itself is never in the email, and you never see or copy it. In the Share a key by email dialog:

Enter the recipient email

The person who should receive the key. They get a one-time reveal link, not the key text.

Set the model scope

Choose which model(s) this shared key may call — the same model-pattern scoping as a normal key, so a shared key can be limited to exactly one deployment.

Optionally add a passphrase and expiry

A passphrase (share it with the recipient separately) adds a second factor to the reveal link. Expiry sets when the key stops working — or leave it as No expiry.

Choose usage visibility, then send

Leave Let them check this key’s usage enabled to let the recipient see the shared key’s usage (you can turn this off per key later). If your workspace uses request logging and you want the recipient to read the prompts sent with this key, also tick Let them read their stored prompts there too — it is off by default because anyone holding the key could then read those prompts. Then click Send invite.

Because a shared key is its own dedicated key, you can revoke it any time to cut off that person’s access without affecting anyone else’s. This is the quickest way to do the per-person keying described in API keys for local models.

If your workspace has request logging turned on, the prompts sent with a shared key are stored too, and the recipient sees a notice saying so on their usage page. They can read those prompts there only if you tick the prompt option above or allow it later in the key’s settings. Tell them before you share the key.

Use your key

Send the key as a Bearer token, and set the base URL to match your client:

OpenAI style (Codex, OpenAI SDKs): https://api.tokios.com/v1
Anthropic style (Claude Code): https://api.tokios.com

curl https://api.tokios.com/v1/chat/completions \
  -H "Authorization: Bearer sk-tok-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gemma-tunnel", "messages": [{"role": "user", "content": "Hello"}]}'

OpenAI SDK (Python):

from openai import OpenAI

client = OpenAI(
    api_key="sk-tok-YOUR_KEY",
    base_url="https://api.tokios.com/v1",
)
response = client.chat.completions.create(
    model="gemma-tunnel",
    messages=[{"role": "user", "content": "Hello"}],
)

Anthropic SDK (Python) — the Anthropic surface has no /v1 in the base URL:

from anthropic import Anthropic

client = Anthropic(
    api_key="sk-tok-YOUR_KEY",
    base_url="https://api.tokios.com",
)
message = client.messages.create(
    model="gemma-tunnel",
    max_tokens=256,
    messages=[{"role": "user", "content": "Hello"}],
)

Key security

Never commit keys to source control. Keep them out of checked-in .env files and hardcoded strings.
Use environment variables and read them at runtime.
Rotate periodically — create a replacement key, update your services, then remove the old one.
Use separate keys per environment so you can revoke one without disrupting the others.
Scope with model patterns so a key can only reach the models it needs.
Know what is stored. By default Tokios keeps no request or response bodies. With request logging on, workspace admins can read the prompts sent with any key in the workspace for 7 days.

Revoke a key

On the Keys tab, find the key and disable or delete it. A revoked key stops authenticating immediately — any request using it is rejected.

Get Started

Models

Concepts

Reference

Create and manage Tokios API keys

Create a key

Use your key

Key security

Revoke a key

​Create a key

​Share a key by email

​Use your key

​Key security

​Revoke a key

Create a key

Share a key by email

Use your key

Key security

Revoke a key