Authentication and API keys

Portal sign-in identifies you in the dashboard. API keys authenticate requests from your applications. Your portal password or browser token is not an application API key.

Send your The-Code key in the HTTP header:

Authorization: Bearer <THE_CODE_API_KEY>

Create and manage keys

Open API keys after signing in. Give each application or environment a descriptive key name. Copy a newly created key when shown and keep it in a server-side environment variable or secret manager.

Suspend a key to stop its use temporarily. Resume a suspended key when appropriate; an expired key cannot be resumed. Delete a key to revoke it permanently. To rotate a credential, create a replacement, update the application, verify the replacement, then delete the old key.

The gateway checks key status and expiry together with account, model, and credit policies. Having a key does not grant access to every upstream model.

Keep credentials private

Never put API keys in frontend JavaScript, URLs, repositories, screenshots, logs, or agent setup prompts. Applications send The-Code keys, not upstream provider credentials. If a key is exposed, revoke it and create a replacement.

Contact Support@the-code.org for account-access help. Do not email passwords or API keys.