Authentication

Authenticate requests to the Tolka Edge API using an API key.

Authenticate requests to the Tolka Edge API using an API key. Every API request must include your Tolka API key as a bearer token.

Bearer tokens

Pass your API key in the Authorization header:

Authorization: Bearer tk-live-xxxxxxxxxxxxxxxx

Tolka API keys use the tk-live- prefix so they are easy to identify as credentials.

API key security

Tolka does not store your plaintext API key.

When a key is created, the plaintext value is shown once. Store it securely because it cannot be recovered later.

On each request, Tolka validates the provided key and associates the request with your account. Invalid or revoked keys return 401 Unauthorized.

Treat API keys like passwords

Anyone with your API key can make requests using your account and consume your available balance. Never commit keys to Git, expose them in frontend code, or include them in public repositories. Use environment variables or a server-side secret manager to store production keys.

Using environment variables

Store your key as an environment variable:

export TOLKA_API_KEY="tk-live-xxxxxxxxxxxxxxxx"

Then use it from your application:

import os
from openai import OpenAI
 
client = OpenAI(
    base_url="https://api.tolkaedge.com/v1",
    api_key=os.environ["TOLKA_API_KEY"],
)

Authentication errors

Requests with a missing, invalid, or revoked API key return 401 Unauthorized.

Example:

{
  "error": {
    "message": "Invalid API key.",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}

Best practices

Use one key per environment. Keep development and production credentials separate.
Keep keys server-side. Never expose a production API key in browser or mobile application code.
Rotate exposed keys immediately. Revoke compromised keys and create a replacement.
Use separate keys for services. This makes usage easier to attribute and manage.

Manage your keys

Create, view, revoke, and manage your API keys from the API Keys Dashboard.