Authentication

All Token360 API requests require authentication using an API key.

API Key Format

Token360 API keys follow the format:

sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys start with sk- followed by a unique alphanumeric string.

Using Your API Key

Include the API key in the Authorization header of every request:

1curl https://api.token360.ai/v1/chat/completions \
2  -H "Authorization: Bearer sk-your-api-key" \
3  -H "Content-Type: application/json" \
4  -d '{"model": "claude-opus-5", "messages": [{"role": "user", "content": "Hello"}]}'

Managing API Keys

Creating a Key

1. Log in to the Token360 Console.
2. Go to API Keys in the sidebar.
3. Enter a descriptive name (e.g., "production", "development") and select a workspace.
4. Click Create and copy the key into your secret manager immediately. If protected key reveal is available for your account, treat it as a recovery mechanism rather than normal application configuration.

Key Security Best Practices

• Never expose keys in client-side code (browser JavaScript, mobile apps). Always call the API from your backend.
• Use environment variables to store keys. Never hardcode them in source code.
• Rotate keys regularly. Create a new key, update your application, then delete the old one.
• Use separate keys for development and production environments.
• Monitor usage in the console to detect unauthorized usage.
• Set spend and IP controls where appropriate. See API Keys and Workspaces for limits, workspaces, IP rules, rotation, and incident response.

Disabling or Deleting a Key

If a key is compromised:

1. Go to API Keys in the console.
2. Find the key and use the toggle to Disable it (temporary) or click Delete (permanent).
3. Create a new key and update your application.

Authentication Errors

If authentication fails, you'll receive a 401 error:

1{
2  "error": {
3    "message": "Invalid API key or token provided",
4    "type": "invalid_api_key",
5    "code": "401"
6  }
7}

Common causes:

• Missing Authorization header
• Incorrect key format (must include Bearer prefix)
• Expired or deleted key
• Key lacks permission for the requested resource

Optional data inspection control

For generation requests, send Token360-DataInspection: true to enable upstream inspection, or false to disable it. Omission defaults to false (NSFW allowed where supported). Only true and false are accepted, case-insensitively. This also applies to native request bodies and queued generation jobs.

ByteDance routes select the matching endpoint SKU. Wan translates the setting to input/output inspection headers. ArgosLab Seedance adds its moderation-bypass header when inspection is disabled and removes it when inspection is enabled. Models without a configured switch retain their upstream behavior, including during fallback.

An explicit platform header overrides X-DashScope-DataInspection. When the platform header is omitted, an existing DashScope header is preserved, including mixed input/output settings. Polling headers do not change a task's creation policy. No compatible route returns HTTP 503 with data_inspection_route_unavailable; selected-SKU pricing still applies.