Get your API key
Generate a show-once tp_sk_ key on the API Keys page, and point the SDK at the collector URL.
Both integration paths need the same two things: an API key and the collector URL. Get them once here.
1. Generate your API key
- Open the dashboard at app.tokenpolice.ai. On your first login it walks you through a short Get started checklist — creating your key is the first item on it.
- Go to API Keys (app.tokenpolice.ai/keys) and click Generate Key.
- Give it a Key Name — something that says where it's used, like
support-api-prod. It's how you'll recognise the key later when you rotate or revoke it. - Copy the key now. It looks like
tp_sk_…and it is shown once. TokenPolice stores only a hash of it, so nobody — including us — can show it to you again. Lose it and you generate a new one.
Treat the key like a password. Put it in an environment variable — don't paste it into source code or commit it to git.
The SDKs read TOKENPOLICE_API_KEY automatically:
export TOKENPOLICE_API_KEY="tp_sk_..."One key is enough for the whole integration: the SDK uses it, and so does your coding agent when it verifies the result.
2. The collector URL
The SDK sends its checks and usage logs to the collector:
https://collect.tokenpolice.aiThat's the built-in default, so the SDK works without setting it. Set it anyway — pass
base_url / baseUrl to init(), or set TOKENPOLICE_BASE_URL. An explicit URL keeps your
app's destination visible in the repo, and it's the one line you change if you self-host or
point at a local stack.
The URLs you'll meet
| What | URL | You use it for |
|---|---|---|
| Dashboard | https://app.tokenpolice.ai | Generate keys, set rules, view spend |
| Collector | https://collect.tokenpolice.ai | The SDK's base_url — checks and logs go here |
What actually gets sent
TokenPolice receives token metadata only: the model, token counts and cost, the identity
tags you choose (user_id, paid_plan, session_id), the names you give your runs and
steps, and a content fingerprint — a hash — used for loop detection. Raw prompt and
completion text never leaves your servers. Full detail on
Data & privacy.