Authentication

Every request needs the X-API-Key header. Keys are created in the portal once a plan is active.

Demo keys

Public keys, shared by everyone who uses them — for evaluating the API before subscribing.

• Prefix: demo_ttp_… (the Quickstart one is demo_ttp_free_2604)
• Rate: 6 rpm (hard cap regardless of tier claimed)
• No AI. PDFs and calls count against the Free quota (5 PDFs and 1,000 calls per month), shared by everyone using the key
• Responses carry an X-Demo-Key: true header

Production keys

• Prefix: ttp_ followed by 32 random characters (secrets.token_urlsafe(32))
• Delivered by email at checkout
• Persistent: they do not rotate automatically — rotate manually in the portal if compromised

Best practices

• Never ship a key in frontend code. Use a backend proxy.
• Watch the X-RateLimit-Remaining header to avoid 429 responses.