Authentication

There are three ways a request can be authenticated.

1. API key — for your server

Create a key on API Keys in the dashboard (it starts with tt and is shown once). Send it in the X-API-Key header:

[!WARNING] Send API keys as X-API-Key, not Authorization: Bearer. The Authorization header is tried as a user JWT first, and a tt key there fails with a confusing 401 Token is invalid or expired.

Keys are server-only. Browsers are blocked by CORS on purpose — for websites, use the [hosted bot API](/dev-docs/hosted-bot-api).

For paid models, also put the same key in the request body as apikey when sending chat messages — that's how usage is charged to your wallet.

2. JWT — acting as a user

Exchange a username and password for tokens:

username takes either the account's username or its email address (an exact username match wins). The response contains access (short-lived) and refresh. Send the access token as Authorization: Bearer <access, and renew it with:

POST /api/jwt/clear/ logs out.

3. Public endpoints

Hosted-bot (/api/hosted/<slug/…), marketplace browsing, subscription plans, the agent webhook trigger and these docs need no auth.

Try it

If you're logged in to BotBazar in this browser, the consoles send your session automatically. Check who you are: