TokenTip
Reference

REST API

All paths are relative to https://tokentip.to/v1 and require Authorization: Bearer tt_…. Responses are JSON; errors are problem+json.

Creator

Available to any valid token, scoped to that token's own account.

GET/v1/me

The authenticated creator's profile and balance summary — handle, display name, current credit, whether a key has been claimed, and the key fingerprint.

GET/v1/balance

Current inference credit plus the live key view fetched from OpenRouter: live_usage, live_limit, and disabled. The live fields are eventually consistent and may be null if the provider is unreachable.

GET/v1/tips

Your tips, newest first.

limit1–100, default 40.
cursorThe previous response's next_cursor.
statusFilter: pending · held · settled · refunded · disputed.
{
  "data": [
    { "id": "369330cb-…", "creator_handle": "copyleftdev", "status": "settled",
      "gross": "5.000000", "net_to_tokens": "4.068225",
      "tipper_name": null, "tipper_note": null,
      "created_at": "2026-07-19T10:03:00Z",
      "held_at": "2026-07-19T10:03:20Z", "settled_at": "2026-07-19T10:07:00Z" }
  ],
  "next_cursor": null
}
GET/v1/tips/{id}

One tip, by id. 404 if it is not yours.

GET/v1/key

The active key's non-secret fingerprint, mint time, and live usage. Never returns the secret — it is not stored. 404 before you have claimed a key.

POST/v1/key/rotate

Disables the current key and mints a replacement carrying the same balance. The new secret is returned exactly once — save it before you close the response. Accepts Idempotency-Key. Emits key.rotated.

{ "secret": "sk-or-v1-…", "fingerprint": "sk-or-v1-117…2dce",
  "limit": "4.068225", "minted_at": "2026-07-19T10:07:00Z" }
GET/v1/stats

Lifetime aggregates: tips total, settled, and held, plus settled gross, settled net (the inference credit you have received), and lifetime gross.

Tokens

Minting without revoking means a leaked token lives forever, so both live here and in the dashboard.

GET/v1/tokens

Your tokens — id, non-secret prefix, name, scope, and when each was created and last used. Never the token itself. A creator-scoped token sees only creator-scoped tokens; an operator token sees every token on the account.

DELETE/v1/tokens/{id}

Revoke immediately. 204 on success, 404 if it is not yours or not visible to your scope. A token may revoke itself. A creator-scoped token cannot revoke an operator-scoped one, so a leaked creator token cannot lock you out of your own operator access.

Webhooks

Register endpoints to receive signed events. See Events for the payloads and signature scheme.

GET/v1/webhooks

Your registered endpoints. Secrets are never returned here.

POST/v1/webhooks

Register an endpoint. Returns 201 with the signing secret once. Omit events to receive everything in scope.

{ "url": "https://you.example/hook", "events": ["tip.settled"] }

Every entry in events must be a type from the catalogue; an unknown one is rejected with 400 rather than silently subscribing you to nothing. stream.lagged is stream-only and cannot be delivered by webhook.

DELETE/v1/webhooks/{id}

Remove an endpoint. 204 on success, 404 if it is not yours.

Streams

GET/v1/events

A text/event-stream of your own events, held open until you disconnect.

GET/v1/operator/eventsoperator

The system-wide stream: every creator's events plus operator-only solvency and abuse signals.

Operator

Requires an operator-scoped token. A creator token gets 403.

GET/v1/operator/overviewoperator

System snapshot: the solvency pool (committed credit, drawable balance, headroom, state), money totals, and vitals.

GET/v1/operator/tipsoperator

Every tip across every creator, newest first. Same pagination and filters as /v1/tips.

GET/v1/operator/creatorsoperator

Creators with balances and live key usage joined in. Takes limit and cursor.

POST/v1/operator/tips/{id}/settleoperator

Force-settle a held tip now, bypassing the fraud-hold window. The solvency guard still applies: if the grant would over-commit the pool the tip stays held and the response says so. Accepts Idempotency-Key.

{ "status": "settled", "message": "settled — inference credit granted" }
POST/v1/operator/creators/{handle}/disable-keyoperator

Kill switch for fraud response — remotely disables a creator's live key. The creator can rotate to restore access.