Authentication & API Keys

The TouAI platform authenticates SDK traffic with project API keys only. Keys are created, rotated, and revoked in the web console; the SDK consumes a key — it has no login, registration, or token-management APIs.

How Keys Are Validated

Every SDK request carries the key pair as HTTP headers:

X-Access-Key-Id: ak_live_...
X-Secret-Key: sk_live_...

The API gateway validates the pair on every call, resolves the key's organization and project, and scopes the request to them. There are no JWTs, sessions, or refresh flows on the API-key channel — each request is authenticated independently.

Key Lifecycle (Web Console)

• Create — open a project in the console and issue a key. The secret is shown once; store it in your secret manager immediately.
• Rotate — issue a replacement secret and invalidate the old one. Update your deployments with the new pair.
• Revoke — disable a key permanently. In-flight requests fail with an authentication error from that point on.

Verifying a Key Works

There is no separate validation endpoint to call from the SDK — any successful data-plane call proves the key is valid and shows what it is scoped to:

from touai import TouAI
 
client = TouAI(access_key_id="ak_live_...", secret_key="sk_live_...")
 
# A cheap read confirms authentication and reveals the key's context
info = client.object_storage.info()
print(info.active_project_id)

An invalid or revoked key raises AuthenticationError on the first call.