AI API Authentication Guide

The Bearer Token Pattern

All major AI APIs use the same authentication pattern: an Authorization header with a Bearer token.

Authorization: Bearer YOUR_API_KEY

This is the OpenAI-compatible standard that TokenEase, DeepSeek, K3, GLM, Qwen, and Doubao all support. One pattern works everywhere.

Environment Variables: The Only Safe Place

Never hardcode API keys in your source code. Use environment variables.

# .env file (never commit this to Git)
OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxx
TOKEN_EASE_KEY=tk_your_token_here

# Python
import os
api_key = os.getenv("TOKEN_EASE_KEY")

# Node.js
const apiKey = process.env.TOKEN_EASE_KEY;

Security Checklist

• Store API keys in environment variables, never in code
• Add .env to .gitignore before the first commit
• Use a secrets manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) in production
• Rotate API keys every 90 days
• Monitor usage dashboards for unexpected spikes
• Restrict API keys by IP address if your provider supports it
• Set spending limits and alerts
• Never expose API keys in client-side JavaScript
• Use separate keys for development, staging, and production
• Revoke keys immediately if compromised

What NOT To Do

• Hardcode API keys in JavaScript files served to browsers
• Share API keys in Slack, email, or chat messages
• Include .env files in Docker images or deployment bundles
• Use the same key across multiple projects or teams
• Log API keys in error messages or application logs
• Store keys in plain text databases or spreadsheets
• Ignore rate limit spikes — they may indicate key theft

Client-Side Protection

If you're building a web app that calls AI APIs from the browser, never put your API key in client-side JavaScript. Anyone can open DevTools and steal it.

// ❌ DON'T: Exposing key in browser
const response = await fetch("https://tokenease.io/v1/chat/completions", {
    headers: { "Authorization": "Bearer sk-EXPOSED_KEY" }  // Anyone can see this!
});

// ✅ DO: Proxy through your backend
const response = await fetch("/api/chat", {  // Your server endpoint
    method: "POST",
    body: JSON.stringify({ message: "Hello" })
});

Revoking a Compromised Key

If you suspect your key has been leaked, act immediately:

1. Generate a new API key in your dashboard
2. Update the environment variable on your server
3. Restart your application
4. Revoke the old key
5. Check usage logs for unauthorized activity
6. Audit where the old key was stored (CI/CD, Docker, team members)

Detecting Key Theft

Watch for these warning signs:

• Sudden spike in API usage (10x normal volume)
• Requests from unexpected IP addresses or countries
• Usage patterns that don't match your application's behavior
• Failed authentication attempts from unknown sources
• Costs rising faster than user growth

Authentication at TokenEase

TokenEase uses the standard OpenAI Bearer token format:

curl https://tokenease.io/v1/chat/completions \\
  -H "Authorization: Bearer tk_your_api_key" \\
  -H "Content-Type: application/json" \\
  -d '{"model":"k3","messages":[{"role":"user","content":"Hello"}]}'

Security features built in:

• Per-key usage tracking and rate limiting
• Instant key revocation from dashboard
• Automatic IP-based anomaly detection
• Spending caps and budget alerts
• Request logging for audit trails