AI MODEL AGGREGATION / SMALL-TEAM GUIDES
Secure your LLM API integration and keys
Guide for developers on securely authenticating with a unified LLM API and protecting sensitive access keys.
The short answer
Secure your LLM integration by using server-side Bearer token authentication and never exposing your API keys in client-side code.
Authentication with Bearer Tokens
To interact with the API, you must include your API key in every request header. The standard format uses the Authorization: Bearer $TOKENBISON_API_KEY header. This ensures that every request is authenticated and associated with your account for proper billing and access control.
Securing Your Keys
A critical security practice for independent developers is to keep API keys on the server. You should never expose these keys in client-side code (such as browser-based JavaScript or mobile app binaries). If you suspect a key has been compromised, you should immediately rotate it or report unauthorized access.
Proposed Secure Workflow
1. Create a secure API key in your console. 2. Store the key as an environment variable on your backend server. 3. Use a proxy or backend endpoint to forward requests to the gateway, ensuring the secret key is never sent to the user's device. 4. Regularly delete old or unused logs to minimize data footprint.
Evidence and boundaries
These are documentation references and proposed evaluation workflows, not measured model rankings or a guarantee of savings. Check the current catalog and policies before use.
TokenBison API documentation · reviewed 2026-09-24
Authorization: Bearer $TOKENBISON_API_KEY Base URL https://tokenbison.com/v1 Keep your key on the server. Never expose it in client code. Examples Send a chat completion Select a model below to generate a ready-to-copy example. Select model Loading... cURL Python JavaScript Copy code curl https://tokenbison.com/v1/chat/completions \ -H "Authorization: Bearer $TOKENBISON_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "YOUR_MODEL_ID", "messages": [{"role": "user", "content": "Hello!"}] }' Need help? Include the request ID when available. hi@tokenbison.com
TokenBison verification and limitations · reviewed 2026-09-24
Experience credit Create an account and explore available models. Verify it yourself Three checks for a new integration. Run these checks against TokenBison and any API service you compare it with. 01 Compare the model ID Send a request and compare the response model field with the ID you selected from the catalog. 02 Inspect token usage Review the returned usage fields and compare them with the request details in your console. 03 Run your own prompt Test with a prompt you know well and public, non-sensitive data before moving an application to production. What this page does not claim.
TokenBison privacy policy · reviewed 2026-09-24
You may delete available logs in the console or request deletion by contacting hi@tokenbison.com . Deletion is subject to technical limitations, legal obligations, and the need to retain limited records for security, fraud prevention, billing, or dispute resolution. Information already sent to a third-party model provider is also subject to that provider's retention practices. 7. Security We use reasonable technical and organisational safeguards designed to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure.
Put the guide into practice
Review current model prices, then make a small API request with public or non-sensitive sample data. Compare the output against your own acceptance criteria.