API Keys
All API requests require authentication using an API key. You can create and manage API keys from your Dashboard.
API Key Format
tork_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxAPI keys start with tork_sk_ followed by a random string.
Keep your API key secret
Your API key provides full access to your Tork account. Never share it publicly, commit it to version control, or include it in client-side code.
Using Your API Key
Include your API key in the Authorization header:
http
Authorization: Bearer tork_sk_your_api_key_hereExample Request
bash
curl -X POST https://tork.network/api/v1/evaluate \
-H "Authorization: Bearer tork_sk_your_api_key_here" \
-H "Content-Type: application/json" \
-d '{"content": "Hello world", "checks": ["pii"]}'SDK Authentication
The cloud SDK @torknetwork/sdk (npm, v2.0.0) handles authentication for you — pass your API key when constructing TorkClient. It is npm-only: there is no Python cloud client, so Python authenticates against the REST API with a Bearer token.
javascript
// npm install @torknetwork/sdk
import { TorkClient } from '@torknetwork/sdk';
// Option 1: Pass API key directly
const client = new TorkClient({ apiKey: 'tork_sk_your_api_key_here' });
// Option 2: Read the key from the environment yourself
const client = new TorkClient({ apiKey: process.env.TORK_API_KEY });Which package is this?
TorkClient belongs to @torknetwork/sdk — the cloud SDK. It sends your content to Tork, which makes the decision server-side and records it as capture_mode=cloud attested_by=tork. The separate on-device family, tork-governance (PyPI and npm), exports Tork instead, decides on-device, and needs no API key at all.Environment Variables
We recommend using environment variables for API keys. This keeps your code clean and makes it easy to use different keys in different environments.
API Key Types
| Type | Prefix | Permissions | Use Case |
|---|---|---|---|
| Secret Key | tork_sk_ | Full access | Server-side applications |
| Restricted Key | tork_rk_ | Limited endpoints | Specific integrations |
| Ephemeral Key | tork_ek_ | Session-scoped | Temporary agent sessions |
Key Management
Best practices for managing your API keys:
- Use different keys for different environments - Create separate keys for development, staging, and production.
- Rotate keys regularly - Generate new keys periodically and revoke old ones.
- Use restricted keys when possible - Limit permissions to only what's needed.
- Monitor key usage - Check the dashboard for unusual activity.
Authentication Errors
| Status | Error Code | Description |
|---|---|---|
| 401 | missing_api_key | No API key provided in request |
| 401 | invalid_api_key | API key is malformed or doesn't exist |
| 401 | expired_api_key | API key has expired |
| 403 | insufficient_permissions | API key doesn't have permission for this endpoint |
json
{
"success": false,
"error": {
"code": "invalid_api_key",
"message": "The API key provided is invalid or has been revoked.",
"status": 401
}
}