API Reference

What signing in and up offers: {providers, captcha: {provider, siteKey} | null, legal: {termsVersion, privacyVersion}}.

Begin a sign-up with {email, password, name?, referralCode?, agree: true, marketingOptIn?, captchaToken}: a 6-digit code is emailed, valid 10 minutes. Answers 202 {attemptId, email, codeExpiresAt}. Passwords are 8–128 characters (72 bytes at most), not a common password and not the email address (400 weak_password).

Finish it with {attemptId, code}: opens the account, its address verified, and answers 201 {user}. Five wrong codes end the sign-up (400 code_attempts_exceeded).

Email a new code with {attemptId}; at most one a minute and five a day per address.

Exchange {email, password} for {user, token}, the token a JWT for scripts. After repeated failures a CAPTCHA token is needed as well (400 captcha_required).

Email a password reset link with {email, captchaToken}; always 202, whether or not an account has the address.

Set a new password with {token, password} from the link (valid once, for 30 minutes); every existing session and JWT of the account ends.

A browser’s sign-in with a provider (google, microsoft or x): ?intent=signin (with ref and next), link or reauth. The round trip is bound to the browser by an HttpOnly cookie (__Host-rt_oauth over https) and uses PKCE (and, for Google and Microsoft, an OpenID Connect nonce); the callback, /v1/auth/:provider/callback, signs the browser in or sends it to complete a sign-up, and a failure comes back as /console/login?error=<code>.

Complete a sign-up that began with a provider, in the browser that holds it, with {email?, agree: true, marketingOptIn?, referralCode?, captchaToken}: 201 {user} for the address the provider vouches for, else a code is emailed (202) and /v1/auth/signup/verify finishes it. GET /v1/auth/signup/pending says who is signing up.

A nonce for signing in with a Web3 wallet (Sign-In with Ethereum, EIP-4361), where the deployment offers it: {nonce}, valid 5 minutes and once. ?intent=link or reauth need the browser’s session.

Sign in with {message, signature, intent}: an EIP-4361 message for this site carrying the nonce, signed by the wallet (an ordinary wallet’s signature is checked offline). Signs the browser in (200) or begins a sign-up to complete (202, a wallet has no email address); 400 wallet_expired or wallet_failed otherwise.

Sign out: ends the session the cookie names and clears the cookie. 204.

Prove again who is using a console session with {password}, before a sensitive action within the next 10 minutes. 204; 403 invalid_credentials; 400 session_required with a bearer JWT (sign in again instead).

Read the current account: {user, legal, orgs:[{orgId,name,role}]}.

The account’s live sessions: {sessions:[{id, createdAt, lastSeenAt, ip, userAgent, method, current}]}.

End one of the account’s sessions. 204; 404 session_not_found. Ending another one than the caller’s needs a sign-in or re-authentication within 10 minutes, else 403 reauth_required.

End every other session: {revoked}. Needs a sign-in or re-authentication within 10 minutes, else 403 reauth_required.

The account’s sign-in methods: {identities:[{id, provider, display, email, createdAt, lastUsedAt}], hasPassword}.

Remove a sign-in method. 204; 409 last_sign_in_method when it is the only way in; needs a sign-in or re-authentication within 10 minutes (403 reauth_required).

Accept the Terms of Service and Privacy Policy in force with {termsVersion, privacyVersion} (the versions /v1/me names): {legal}; 409 legal_version_outdated for any other version.

Change the display name with {name} (1–80 characters).

Change the password with {currentPassword, newPassword}. Every other session and JWT ends; the answer carries a new token.

Change the account’s email address with {email}: a 6-digit code is emailed to the new address, valid 10 minutes (202 {changeId, email, codeExpiresAt}), at most one a minute and five a day per address. Needs a sign-in or re-authentication within 10 minutes (403 reauth_required); 400 disposable_email. POST /v1/me/email/verify with {changeId, code} changes it: every other session and JWT ends, the answer carries a new token, and the old address is told.

A copy of the personal data Token Engine holds about the account, as one JSON document: profile, sign-in methods, sessions of the last six months, API key metadata, organizations, legal acceptances, consents, trial, balance, cards and invoices. It holds no secret.

Close the account with {confirmEmail}, its address typed. Needs a sign-in or re-authentication within 10 minutes. Every API key and session ends at once; 409 with blockers while it is the only owner of an organization with other members, its balance is below zero, or reseller commission or a payout is open. Its personal details are anonymised 30 days later.

List personal API keys, or an organization’s with orgId.

Create keys with {name, orgId?, expiresAt?, spendCap?: {credits, window: "daily"|"monthly"|"total"}, allowedModels?, quantity?} (the older monthlyQuotaCredits is still accepted). A key belongs to the personal account by default; name an organization and its usage is charged to that organization’s shared balance. allowedModels takes exact catalog model ids and vendor/* wildcards (omit it, or pass ["*"], for every model); any other model is refused with 403 model_not_allowed. A quantity above one returns {data:[…]}. This response is the only time a key’s secret is shown.

Rename, disable or re-enable a key, or change its expiry, spend cap, allowed models or routing defaults.

Revoke one of the caller’s API keys.

Create an organization with {name}; the creator becomes its owner.

List the organizations the caller belongs to, with their role.

List an organization’s members; the caller must be one.

Add an existing user with {email, role}; owner or admin only.

List the enabled models this key may call, their providers and customer prices, and each model’s license_url (null when none is recorded).

The same catalog for a signed-in session, which the console browses.

One model with the providers serving it (endpoints): each one’s customer price, regions and data policy, its usage policy (policy_url, null when not recorded) and whether it is Token Engine First-Party (first_party).

Create an OpenAI-style chat completion, streaming over SSE if asked.

Create a top-up intent with {amount, currency?, orgId?}; the personal account by default.

The account’s usage records over [from, to) as CSV, oldest first, at most 12 months per request and none older than 12 months: created_at, request_id, model, provider, request_kind, status, error_code, api_key_id, api_key_name, prompt_tokens, completion_tokens, cached_tokens, cache_write_tokens, total_tokens, token_source, charge_credits, latency_ms, ttfb_ms. An organization’s with orgId for its members; 404 for any other account.

Read the personal balance. A JWT may pass orgId for an organization’s; an organization’s API key reads its own.

Summarize usage over a period, for the personal account or an organization. Usage is shown for the last 12 months: an earlier start is moved up to it, and a period entirely older is refused with 400 range_too_old.

List invoices, personal or for an organization.

Download a monthly statement as a PDF. Statements are issued automatically once a month closes.

Apply to become a reseller; the application starts pending.

Create a referral code (approved resellers): 4–32 letters, digits, - or _, unique regardless of case.

List the caller’s codes and how many users each referred.

List accrued or paid commissions.

Status, rate, referred users and commission totals.