API Keys
Generate, replace and delete the key your app sends with every report — and what revocation does to a running app.
API Keys (sidebar → Current Project → API Keys) holds the SDK keys for one project. Each key authenticates your app so TokenPolice knows whose spending it is looking at.
What it's for
One key per app or environment. The page's own description: "These keys are used to authenticate your application with the TokenPolice Analytics Collector... The full key is shown only once at creation — store it securely, and replace it if you lose it."
The table
| Column | Shows |
|---|---|
| Name | The name you gave the key. |
| API Key | A masked value — the prefix and last four characters only. |
| Created | When it was issued. Newest first. |
| Actions | Replace (issue a new key, revoke this one) and Delete. |
Creating one
Click Generate Key. A modal opens titled New API Key.
Type a Key Name — something like Production Web App. The button stays disabled until you do.
Click Generate Key again. The full key appears once: "Copy this key now. For your security, it will not be shown again." Dismiss with I've saved the key.
Keys look like tp_sk_... and are 77 characters long. We store only a hash of it plus the masked
prefix and last four, so there is no key recovery — if you lose one, replace it.
Replace and delete
- Replace revokes the current key and issues a new one with the same name, in one step. The dashboard warns: "Any application still using the old key will stop sending analytics until you update it with the new key."
- Delete removes the key outright: "If this key is being used in your application, token analytics and budget enforcement will stop working immediately."
Revocation takes effect near-instantly. An app still holding a revoked key keeps running — the SDK is fail-open, so your users see nothing — but it stops reporting spend, and your rules stop seeing its traffic. Deploy the new key before, or immediately after, you replace.
Creating, replacing and deleting are admin-only; any member can view the list.
Using the key
Set both values in your app's environment:
TOKENPOLICE_API_KEY=tp_sk_...
TOKENPOLICE_BASE_URL=https://collect.tokenpolice.aiWhat to look for
- No rows at all — your app can't be reporting. Create one, or check Get started.
- Traffic stopped after a replace — something is still on the old key. Search your deploys and
local
.envfiles for the old prefix. - A key you don't recognise — delete it; every key create and revoke also arrives as an account notification.