Authentication

API keys charge the account that owns the key. OAuth lets each connected user use their own credits.

API keys#

Use a server-side API key for your account, or OAuth for each customer’s account. Never send keys in prompts or tool arguments.

HTTP

Authorization: Bearer $TONG_API_KEY

QuickstartCreate an API key, find a model, quote a request and follow its result.Tool referenceBrowse every creative tool and its request schema.

OAuth discovery#

API keys charge the account that owns the key. OAuth lets each connected user use their own credits.

curl 'https://platform.tongai.io/.well-known/oauth-authorization-server'

Configuration

curl --version

HTTP

GET /.well-known/oauth-protected-resourceGET /.well-known/oauth-protected-resource/mcp

Authorization and consent#

OAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.

JSON

{  "response_type": "code",  "client_id": "https://your-app.example/oauth/client.json",  "redirect_uri": "https://your-app.example/oauth/callback",  "resource": "https://platform.tongai.io/mcp",  "scope": "catalog:read operations:read generation:write quotes:write credits:spend",  "code_challenge_method": "S256",  "code_challenge": "BASE64URL_SHA256_OF_VERIFIER",  "state": "RANDOM_SESSION_STATE"}

HTTP

code_expires_in: 60 secondsaccess_token_expires_in: 300 secondsrefresh_token_expires_in: 30 daystoken_endpoint_auth_method: noneclient_id_metadata_document_supported: true

GET /oauth/authorizeOAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.POST /oauth/tokenOAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.POST /oauth/revokeOAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.

Permissions#

Paid tools also require credits:spend. Delete permissions are separate.

Tool referenceBrowse every creative tool and its request schema.MCP setupConnect Tong in your MCP client, authorize your account, then discover and call the permitted creative tools.