Authentication

Every 词元兽-TokenMons endpoint requires an API key, passed in the Authorization request header.

Get an API key

1. Open the API Keys page — Sign in to the 词元兽-TokenMons console and open the API Keys page.
2. Generate a new key — Click New key. The full key string (sk-…) is shown exactly once — copy it to a secret store immediately.
3. Name and manage the key — Add a description so you remember what the key is for. You can disable, re-enable, or delete any key at any time from the same page.

The full key is shown only once, at creation. If you lose it you cannot recover it — disable the old key and generate a new one.

Send authenticated requests

Include the key as a Bearer token in the Authorization header:

Authorization: Bearer <API Key>

A minimal request:

curl https://api.hotrouter.ai/v1/chat/completions \  -H "Authorization: Bearer $API_KEY" \  -H "Content-Type: application/json" \  -d '{    "model": "your model ID",    "messages": [      { "role": "user", "content": "Hello" }    ]  }'

The same header works for every endpoint — chat, images, video, speech, and GET /v1/models.

SDK setup

Most OpenAI-compatible SDKs accept a base_url override. Point it at 词元兽-TokenMons and pass your key:

from openai import OpenAIclient = OpenAI(    api_key=os.environ["API_KEY"],    base_url="https://api.hotrouter.ai/v1",)

import OpenAI from "openai";const client = new OpenAI({  apiKey: process.env.API_KEY,  baseURL: "https://api.hotrouter.ai/v1",});

Best practices

• Never commit keys to source control. Use environment variables, gitignored .env files, or a secret manager.
• Rotate regularly. Generate a new key and disable the old one when a teammate leaves, when you suspect a leak, or on a fixed cadence.
• One key per workload. Per-service keys make leaks easy to scope and disable without disrupting unrelated traffic.
• Server-side only. Treat the key like a database password — never ship it in a browser bundle or mobile app.

Errors

Authentication failures return a JSON error body:

{  "error": {    "code": "unauthorized",    "message": "unauthorized",    "type": "error"  }}

Status codes: