Authentication

API keys

All requests require a Bearer token:

curl -H "Authorization: Bearer tk_your_api_key" \
  https://api.thankyouai.com/open/v1/models

Keys use the tk_ prefix for easy identification. Each key is bound to a team and comes with an independent webhook_secret for verifying webhook signatures.

When you create an API key, the response includes both the full key and webhook secret — these are shown only once. Store them securely.

Scopes

Scopes are capability-based, not endpoint-based. A key may be allowed to call POST /open/v1/generate, but the resolved model/task must still belong to an allowed capability.

Scope	Access
`*`	All capabilities
`image`	Image generation and editing
`video`	Video generation
`tts`	Text to speech
`sound_effect`	Sound-effect generation
`voice_clone`	Voice cloning
`voice_change`	Voice transformation

Examples:

A key with image can call google/nano-banana/pro/text-to-image.
A key with video can call bytedance/seedance/v2/text-to-video.
A key with tts can call fish-audio/text-to-speech.

Rate limits

Limits apply per API key:

Tier	Requests/min	Concurrent generations
Free	10	3
Pro	60	20
Enterprise	300	100

Rate-limit headers are returned on every response:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1711526400

Billing

Each key is attached to a billing entity. A create call reserves credits when the generation starts and settles them when the generation reaches a terminal state.

Security best practices

Store keys in environment variables
Use separate keys for production and development
Scope keys as narrowly as possible
Rotate and revoke keys regularly

Never expose API keys in client-side code or public repositories.