API Keys

What are API Keys?

API keys are unique identifiers that authenticate your requests to the Tork API. Each key is tied to your organization and grants access to all Tork services within your plan's limits.

Your API key looks like this: tork_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Creating and Managing Keys

Creating a New Key

1. Go to the API Keys page in your dashboard
2. Click "Create Key"
3. Give your key a descriptive name (e.g., "Production Server", "Development")
4. Important: Copy and save your key immediately - you won't be able to see it again

Using Your Key

Include your API key in the Authorization header:

curl -X POST https://api.tork.network/v1/govern \
  -H "Authorization: Bearer tork_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "my-agent", "action": "check"}'

Revoking a Key

If a key is compromised or no longer needed, revoke it immediately from the dashboard. Revoked keys stop working instantly.

Security Best Practices

Environment Variables Example

# .env file (never commit this!)
TORK_API_KEY=tork_live_your_api_key_here

# In your application
import os
api_key = os.environ.get("TORK_API_KEY")

// Node.js example
const apiKey = process.env.TORK_API_KEY;

// Always validate the key exists
if (!apiKey) {
  throw new Error("TORK_API_KEY environment variable is required");
}

When to Rotate or Revoke Keys

Revoke and create new keys in these situations:

• Key exposed: If your key was committed to a public repo, shared in a public channel, or otherwise leaked
• Team member leaves: When someone with key access leaves your organization
• Unusual activity: If you see unexpected API calls or usage patterns
• Regular rotation: As part of your security hygiene (every 90 days recommended)
• Security incident: After any security breach, even if keys weren't directly involved

Key Limits by Plan

Each plan has different limits for the number of API keys you can create:

Need more keys? Upgrade your plan or contact us for Enterprise options.