# Get your API key (/docs/get-started/api-key)



Both integration paths need the same two things: an **API key** and the **collector URL**.
Get them once here.

## 1. Generate your API key [#1-generate-your-api-key]

1. Open the dashboard at [app.tokenpolice.ai](https://app.tokenpolice.ai). On your first
   login it walks you through a short **Get started** checklist — creating your key is the
   first item on it.
2. Go to **API Keys** ([app.tokenpolice.ai/keys](https://app.tokenpolice.ai/keys)) and click
   **Generate Key**.
3. Give it a **Key Name** — something that says where it's used, like `support-api-prod`. It's
   how you'll recognise the key later when you rotate or revoke it.
4. **Copy the key now.** It looks like `tp_sk_…` and it is shown **once**. TokenPolice stores
   only a hash of it, so nobody — including us — can show it to you again. Lose it and you
   generate a new one.

<Callout type="warn">
  Treat the key like a password. Put it in an environment variable — don't paste it into
  source code or commit it to git.
</Callout>

The SDKs read `TOKENPOLICE_API_KEY` automatically:

```bash
export TOKENPOLICE_API_KEY="tp_sk_..."
```

One key is enough for the whole integration: the SDK uses it, and so does your coding agent
when it verifies the result.

## 2. The collector URL [#2-the-collector-url]

The SDK sends its checks and usage logs to the **collector**:

```
https://collect.tokenpolice.ai
```

That's the built-in default, so the SDK works without setting it. Set it anyway — pass
`base_url` / `baseUrl` to `init()`, or set `TOKENPOLICE_BASE_URL`. An explicit URL keeps your
app's destination visible in the repo, and it's the one line you change if you self-host or
point at a local stack.

## The URLs you'll meet [#the-urls-youll-meet]

| What      | URL                              | You use it for                                 |
| --------- | -------------------------------- | ---------------------------------------------- |
| Dashboard | `https://app.tokenpolice.ai`     | Generate keys, set rules, view spend           |
| Collector | `https://collect.tokenpolice.ai` | The SDK's `base_url` — checks and logs go here |

## What actually gets sent [#what-actually-gets-sent]

TokenPolice receives **token metadata only**: the model, token counts and cost, the identity
tags you choose (`user_id`, `paid_plan`, `session_id`), the names you give your runs and
steps, and a content fingerprint — a hash — used for loop detection. &#x2A;*Raw prompt and
completion text never leaves your servers.** Full detail on
[Data & privacy](/docs/concepts/data-privacy).

## Next [#next]

<Cards>
  <Card title="Use your coding agent" href="/docs/get-started/coding-agent/overview" description="Recommended. Let the skill wire it for you." />

  <Card title="Manual setup — Python" href="/docs/get-started/manual-python" description="Install, init, wrap your entrypoint, run." />

  <Card title="Manual setup — Node" href="/docs/get-started/manual-node" description="The same setup in Node / TypeScript." />

  <Card title="Managing your keys" href="/docs/dashboard/api-keys" description="Rotating, revoking, and what the masked display shows." />
</Cards>