> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tokenchange.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Inference keys

> Create TokenChange inference keys, limit them to specific endpoints, set an expiry, and regenerate or revoke a key that may have leaked.

An inference key authenticates requests to the [inference API](https://docs.tokenchange.io/inference/overview.md). Keys start with `ask_` and are sent as a Bearer token:

```bash theme={null}
Authorization: Bearer ask_...
```

Inference keys only call models. To manage your account from code, use an [API token](https://docs.tokenchange.io/api-reference/introduction.md#authentication) instead.

## Create a key

**1. Open inference keys**

In the dashboard, open **Inference keys** and select **New inference key**.

**2. Name the key**

Use a name that says where the key runs, such as `production server`.

**3. Choose a scope**

Leave the scope at all endpoints, or turn on **Limit to specific endpoints** and enter up to five endpoints, separated by commas. Use the identifier from the **Endpoint** column on a model's catalog page. See [Scopes](#scopes).

**4. Choose an expiry**

Pick **Never**, **7 days**, **30 days** or **90 days**.

**5. Copy the secret**

The secret is shown once. Store it in a secret manager or an environment variable. TokenChange can't show it again.

You can also create keys with the REST API: [`POST /v1/keys`](https://docs.tokenchange.io/api-reference/keys/create-key).

## Scopes

| Scope | What the key can call |
| - | - |
| All endpoints | Every model in the catalog, on any of its endpoints |
| Specific endpoints | Only the endpoints you listed |

A key limited to specific endpoints only sees the models those endpoints serve in [`GET /v1/models`](https://docs.tokenchange.io/inference/models). Requests stay within the allowed endpoints, including when a request fails over. If none of a model's allowed endpoints can serve it, the request fails with `403`.

Use endpoint scopes to keep a workload on providers you've evaluated, or to cap spend by only allowing endpoints within your price range.

## Regenerate a key

Regenerating issues a new secret for the same key and invalidates the old secret. Do this when a secret may have leaked. Select **Regenerate** on the key's row, then update every place that uses the key.

## Revoke a key

Revoking a key permanently stops it from working. Select **Revoke** on the key's row. Requests with a revoked or expired key fail with `401 invalid_api_key`.

## Keep keys safe

* Call the inference API from your server, not from a browser or mobile app where the key is visible.
* Use one key per app or environment so you can revoke one without affecting the others.
* Set an expiry on keys used for short-lived work.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.