Authentication

to.it.com uses Bearer token authentication with workspace-scoped API keys.

Create an API key

1. Sign in to your dashboard
2. Go to Settings → API Keys
3. Click Create key, give it a name, and optionally set an expiration date
4. Copy the key immediately — it is shown only once

API keys are available on Personal, Pro, and Business plans.

Using your key

Include the key in the Authorization header:

curl https://api.to.it.com/v1/short-links \
  -H "Authorization: Bearer toit_YOUR_KEY_HERE"

Keys are prefixed with toit_ for easy identification.

Security best practices

1. Never expose keys in client-side code — proxy requests through your backend
2. Use separate keys per environment (development, staging, production)
3. Revoke compromised keys immediately from the dashboard
4. Rotate keys by revoking the old key and creating a new one

Scopes

Each key is created with read/write access to short links and analytics. Per-key scope selection will be available in a future update.