Skip to main content
Every request to the TrueFan API is authenticated with an API key, scoped to a single workspace.

​
Creating a key

API keys are created, listed, and revoked from the TrueFan dashboard’s API Keys page — any active member of a workspace can manage keys there, not just owners/admins, the same way any member can already trigger a generation that spends the workspace’s shared credits.
The raw key is shown exactly once, right after you create it. It is never stored in a retrievable form and can never be shown again — if it’s lost, revoke it and create a new one from the dashboard.

​
Using a key

Every other endpoint in this API — templates, generation, status, webhooks — lives on the editor host and is authenticated with the raw key as a bearer token:
​
string
required
Bearer {api_key} — every request without a valid, active key returns 401 Unauthorized.

​
Revoking a key

Revoke a key from the same API Keys page in the dashboard. A revoked key stops authenticating immediately. There’s no way to un-revoke a key — create a new one instead.

​
What a key can see

An API key inherits the workspace it belongs to:
  • Templates — only templates that exist in that workspace.
  • Generations & bulk jobs — only ones created by that workspace (whether from the API or the dashboard).
  • Billing — usage is charged to the workspace’s account, and attributed back to the specific key that spent it, so you can see which integration is driving cost.
Every active key in a workspace can read every template in it — there is currently no way to restrict a key to a subset of templates.