Security

Security and data

How we protect your account, keys and data, and what you can do yourself. To report a security issue, email [email protected].

Account and keys

Passwords are stored hashed with bcrypt; we cannot see yours. If you forget it, sign in with an email code and set a new one under Account → Sign-in and security.
Key lists never show a full key. When you need it, sign in and choose Show key on the API Keys page.
Install commands from Connect tools never contain a full key: either the command carries a single-use pass valid for 15 minutes, or you type the key into your own terminal.
Coding tools you signed in to with your TokLens account can be revoked one by one under Signed-in tools, and Account → Sign-in and security signs you out everywhere.

Each call records its time, key, model, token counts, cost, duration, IP address and client (User-Agent), for billing and Usage details.
Request and response bodies are not stored by default. To investigate faults or abuse we may turn on full-content logging for specific keys, specific models or all requests, and when usage analysis is on, text is classified automatically after common sensitive formats are masked. The privacy policy covers the scope and retention.
Error details for failed requests are deleted automatically after about 30 days.
Requests are passed to the model's provider, which handles that data under its own policies.

Card payments are processed by Stripe; we do not store card numbers.
USDC payments are recorded on a public blockchain, where anyone can see the paying address and amount.

Do not commit keys to code repositories or put them in screenshots or chats; hide keys and email addresses before sharing a screenshot. TokLens staff will never ask for your full key or password.
Use one key per project or device and allocate only the balance you need soon. If you turn on auto refill, set a daily cap.
If a key may have leaked, move its balance back with “Move Key balance back to the wallet” on the wallet page, then create a new key. To disable the old key for good, email [email protected]. For a key issued by an administrator, ask the administrator to disable it.

If you find a vulnerability or something suspicious, email [email protected] with the steps to reproduce it and its likely impact.
Please do not access or change other people's accounts or data, and do not run tests that disrupt the service. We will look into it promptly and reply once confirmed.