Authentication

Every request to the THROUGHPUTS API must include a Bearer token. This doc covers how to create, use, rotate, and revoke API keys.

API keys

API keys are strings that start with thp_live_ (production) or thp_test_ (sandbox). Create them in the dashboard under API Keys.

Sending a key

Send your key in the Authorization header:

curl https://api.throughputs.dev/v1/models \
  -H "Authorization: Bearer thp_live_xxx"

With the OpenAI SDK

Pass apiKey and baseURL to the constructor — that's it:

from openai import OpenAI

client = OpenAI(
    api_key="thp_live_xxx",
    base_url="https://api.throughputs.dev/v1",
)

Load the key from an environment variable in production. Never hardcode it.

Key scopes

Every key has a scope that limits what it can do:

Restrict every key to the minimum it needs. A backend service that only answers user chats should get completions-only, not full.

Rotation

Rotate keys every 90 days, or immediately if one is leaked.

1. Create a new key in the dashboard.
2. Update your application to use the new key (e.g. roll the env var).
3. Wait until requests on the old key drop to zero (check the dashboard).
4. Revoke the old key.

Security best practices

• Never commit keys. Use a secrets manager or .env files (and .gitignore them).
• Never ship keys in client-side code. All requests must originate from your backend.
• Set per-key spend limits in the dashboard to cap blast radius.
• Use scoped keys. Don't give a key full access if read-only will do.
• Rotate on schedule. Treat rotation as a quarterly hygiene task, not an incident response.

What happens if a key leaks

If you suspect a key is compromised:

1. Revoke it immediately in the dashboard. Outstanding requests on that key start failing within seconds.
2. Check the usage graph for the compromised key. THROUGHPUTS support can refund clearly-attributable abuse.
3. Create a new key with the same scope and roll your deployment.