Authentication
How Tawa authenticates API requests with API keys.
Every request to the Tawa API is authenticated with an API key, passed
as a bearer token or the x-api-key header:
curl -X POST "https://gateway.tawaguard.com/v1/scan" \
-H "Authorization: Bearer $TAWA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"text": "…"}'Keys are secret. Don't embed them in client-side code, mobile apps, or public repositories.
Verify a key
POST /v1/verify checks a key and returns its metadata:
curl -X POST "https://gateway.tawaguard.com/v1/verify" \
-H "Authorization: Bearer $TAWA_API_KEY"{
"valid": true,
"key": { "id": "…", "name": "Production key", "enabled": true, "requestCount": 42 }
}Managing keys
Create and revoke API keys from the dashboard under Settings → API keys.
Errors
A missing or invalid key returns 401:
{ "error": "Invalid API key", "code": "INVALID_API_KEY" }Building with an official SDK? TypeScript
and Python both call /verify
automatically on client construction, so a bad key surfaces immediately
rather than on the first scan call — see those pages for the SDK-specific
behavior.