Authentication

Every request to the hosted API must carry an API key in the Authorization header, using the Bearer scheme:

curl https://api.trusttyped.com/v1/extract \
  -H "Authorization: Bearer tt_live_EXAMPLE0000000000000000000000000000000000" \
  -H "Content-Type: application/json" \
  -d '{ "schema": {"ok": "bool"}, "input": {"text": "yes"} }'

Key format

An API key looks like:

tt_live_8Kd2mQpX_<43 random characters>_<6 checksum characters>

• tt_live_… is for production, tt_test_… for testing.
• The part tt_live_8Kd2mQpX is the prefix — safe to display and log. You will see it in the platform next to each key.
• The full key is shown once when created. The server stores only a keyed hash (HMAC-SHA256), so it can never be recovered.

Keeping the key safe

• Store keys in a secret manager or environment variable, never in source control or client-side code.
• Use a separate key per project and per environment so one leak has a small blast radius.
• Rotate keys periodically and on any suspected exposure.

Revoking a key

Revoke a key from API keys in the platform. Revocation is propagated to the gateway almost immediately (well under a second) and the key starts returning 401 right away. Create a replacement key and roll your clients over.

Authentication errors

Missing or invalid credentials return 401 with a JSON error body:

code	Meaning
missing_api_key	No Authorization header was sent.
invalid_authorization_header	The header was not Bearer <key>.
invalid_api_key	The key is malformed, unknown, or revoked.

{
  "error": {
    "type": "authentication_error",
    "code": "invalid_api_key",
    "message": "API key tidak valid atau sudah dicabut.",
    "param": null,
    "request_id": "req_01J9Z3K5T7W2Q8M4N6P0R1S2V3",
    "doc_url": "https://docs.trusttyped.com/errors#invalid_api_key"
  }
}

The WWW-Authenticate: Bearer realm="trusttyped" header is set on 401 responses. See Errors for the full list.