Docs menuAPI Keys
API Keys
Create and rotate Bearer keys without losing account control
API key management lives in your TurnitPass workspace. This page documents the key lifecycle, security model, and request pattern for production integrations.
Developer workspace
Platform overview
Open workspace
Create a workspace API key
Sign in, name the key, copy it once, and store it in your own secret manager.
Read auth docs
Review Bearer authentication
Confirm header format, storage rules, revocation behavior, and environment separation.
/api/v1/statuscurl https://turnitpass.com/api/v1/status \
-H "Authorization: Bearer tp_live_your_api_key"API key
Key format
Protected
Storage
5 active
Default limit
review board
01
Key format
Keys are shown only once after creation and can be rotated from the workspace.
02
Storage
Secret material is protected after the first reveal and is never shown again.
03
Default limit
Keep production, staging, and local keys separate instead of sharing one token.
Private by default
Workspace actions require a signed-in account.
Key lifecycle
A small operating loop for each integration
Name the environment
Use clear labels such as Production API, Staging QA, or Partner demo so usage logs stay readable.
Copy the key once
The full token is only revealed on creation. Store it in your app secrets, not in client-side code.
Call status first
Use GET /api/v1/status to verify the key, remaining balance, limits, and account ownership before sending user text.
Rotate without downtime
Create the replacement key, deploy it, confirm traffic, then revoke the old key from the workspace.
Security details