L10 · Spec · 4 min
What is an API (and an API key)?
In one sentence
An API is a structured messenger contract that lets your app's backend ask another service (such as an AI provider) for work over the internet, and an API key is the private password your server sends to prove it has permission and pay for that request.
Think of it like this
An API is like a standardized order slip between a hotel kitchen and a trusted bakery across town: your kitchen sends a precise request (“12 croissants, plain”) and gets back a structured box. The API key is the hotel's charge-account stamp on the slip—anyone who steals that stamp can order pastries on your bill.
How it works
Programs don't click buttons to talk to each other; they use an DefinitionAPIThe agreed way two programs talk to each other, like your app asking an AI provider for an answer.Open in the glossary → (Application Programming Interface). Your app's DefinitionbackendThe part of an app that runs on a server: it keeps data, checks logins and talks to other services.Open in the glossary → sends an HTTPS request formatted as structured text (JSON) to a specific address—such as https://api.tokentide.app/v1—and receives a structured JSON response a moment later.
Because external services cost money or hold private data, they require an DefinitionAPI keyA password your app uses with another service. Whoever has it can spend your money.Open in the glossary → on every request. For example, a Tokentide key starts with tt_live_ and is shown only once when you create it. Whoever has that key can spend your prepaid balance, which is why you always set a daily spending cap and use a separate low-cap key for local development.
Your app reads each API key from an Definitionenvironment variableA named slot, like `TOKENTIDE_API_KEY`, that holds a setting or secret outside your code.Open in the glossary →—such as TOKENTIDE_API_KEY or AI_GATEWAY_API_KEY—kept only in DefinitionVercelThe service that turns your code on GitHub into a live site, with a Preview for every change.Open in the glossary → (type Secret) and in .env.local on your computer. You paste keys there yourself; you never paste an API key into the chat, into your code, or onto GitHub.
All API calls that use a DefinitionsecretAnything that opens your accounts: API keys, passwords, tokens. Kept only in Vercel and `.env.local`.Open in the glossary → key happen strictly on the server (in Next.js Server Actions or Route Handlers), never in the visitor's browser. If a key ever leaks, you revoke it immediately on the provider's website, create a new one, and update Vercel and .env.local.
What it looks like in your project
When your plan reaches an AI feature, your agent prepares .env.local with empty TOKENTIDE_API_KEY= and AI_GATEWAY_API_KEY= lines and guides you to paste your keys in VS Code and in Vercel Settings. Then it runs npm run check-env, which checks only whether each variable name is set or missing—never printing the secret value.
Copy for your agent
Check which external APIs my project uses, confirm all API calls run strictly on the server, and run a check that shows only whether their environment variable names are set or missing.
Quick check · 1 question