TinyLimiter uses API keys for authentication. Each key is scoped to a single product and mode.

API Key Format

ts_limiter_{mode}_{32_random_characters}

Examples:

ts_limiter_test_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
ts_limiter_live_x9y8z7w6v5u4t3s2r1q0p9o8n7m6l5k4

Test vs Live Mode

:::tip Start with a test key during development. Switch to live when you're ready for production. :::

Making Authenticated Requests

Include your API key in the Authorization header:

curl -X POST https://limiter.tinyscale.io/v1/check \
  -H "Authorization: Bearer ts_limiter_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{"namespace": "api", "identifier": "user_1", "limit": 10, "window": 60000}'

Header Formats

Both formats are accepted:

Authorization: Bearer ts_limiter_test_xxx

Authorization: ts_limiter_test_xxx

Key Security

1. Never commit keys to version control - Use environment variables
2. Keys are shown once - Store them securely after creation
3. Rotate compromised keys - Create a new key, migrate, then revoke the old one
4. Use test keys for CI/CD - Avoid consuming production quota

# .env file
TINYSCALE_API_KEY=ts_limiter_live_xxx

# Access in code
const apiKey = process.env.TINYSCALE_API_KEY;

Managing Keys

Create a Key

1. Go to dashboard.tinyscale.io/keys
2. Click Create Key
3. Select product (TinyLimiter) and mode (test/live)
4. Name your key (e.g., "Production API", "CI/CD Testing")
5. Copy and store the key securely

Revoke a Key

1. Go to dashboard.tinyscale.io/keys
2. Find the key you want to revoke
3. Click the revoke button
4. Confirm revocation

:::caution Revoking a key is immediate and cannot be undone. Any requests using the revoked key will receive a 401 Unauthorized error. :::

Subscription Requirements

Live mode keys require an active subscription. If your subscription lapses, live keys will return 402 Payment Required until you resubscribe.

Test mode keys always work, regardless of subscription status.