API access

On the Scale plan, you can read your TokenFront data from scripts, spreadsheets and BI tools with an API token. The API is read-only: a token can read everything in your organization, but it can't change anything.

Creating a token

1. Go to Account → API. Only the organization's Owner can create and revoke tokens.
2. Give the token a name that says where it's used (for example "Looker export") and select Create token.
3. Copy the token straight away. It starts with tf_ and is shown only once. TokenFront stores only a one-way hash of it, so it can't be shown again. If you lose it, revoke it and create a new one.

An organization can have up to 10 tokens. The API page shows when each was last used, and Revoke stops a token working immediately.

Tokens are revoked automatically when the person who created them leaves the organization, is removed from it, or deletes their account, since they saw the full token when it was created. If an integration should outlive one person, have the current Owner create its token.

Making requests

Send the token in the Authorization header:

curl -H "Authorization: Bearer $TOKENFRONT_TOKEN" \
  "https://api.tokenfront.io/api/v1/public/summary?start_date=2026-09-01"

import os, requests

resp = requests.get(
    "https://api.tokenfront.io/api/v1/public/costs",
    headers={"Authorization": f"Bearer {os.environ['TOKENFRONT_TOKEN']}"},
    params={"start_date": "2026-09-01", "limit": 1000},
)
resp.raise_for_status()
print(resp.json()["total"])

Dates are YYYY-MM-DD. Amounts are US dollars.

Endpoints

All paths are under https://api.tokenfront.io/api/v1/public.

GET /platforms

Your platform connections, so you can put names to the platform_id on each cost record.

{ "data": [ { "id": 12, "name": "OpenAI", "platform_type": "openai", "is_active": true } ] }

GET /summary

The same summary the dashboard shows: totals, month-to-date, year-to-date, daily costs, and spend by platform and by model.

Parameter	Default
start_date	The 1st of the current month
end_date	Today

GET /costs

Individual cost records, newest first, a page at a time.

Parameter	Notes
start_date, end_date	Optional date range
platform_id	One connection, from /platforms
model	An exact model id
search	Matches the model or API key name
sort	date_desc (default), date_asc, cost_desc or cost_asc
limit	1–1000, default 100
offset	For the next page: add limit to it until you reach total

{
  "data": [
    {
      "id": 90211, "platform_id": 12, "record_date": "2026-09-27",
      "amount_usd": 41.87, "currency": "USD", "model": "gpt-4o",
      "api_key_name": "search-prod", "input_tokens": 5210331, "output_tokens": 480112,
      "budget": "Search team"
    }
  ],
  "total": 1834, "limit": 100, "offset": 0
}

Records also carry category, total_requests, api_key_id, description and source, plus cost_basis, which says where the dollar amount came from:

• vendor: reported by the provider at exactly that level (day, model, and key where it has one).
• allocated: a provider-reported total that TokenFront split, usually across API keys, since OpenAI and Anthropic don't price individual keys. Allocated rows always sum back to the provider's own total.
• estimated: a provisional figure (tokens at list price) for spend the provider hasn't billed yet, such as AWS Bedrock's most recent day. A later sync replaces it with the billed amount.

Older records may have no cost_basis. budget is the budget the record counts toward, or null. list_usd is the same tokens at the provider's published prices, for provider-billed records (vendor or allocated), or null.

GET /anomalies

Parameter	Notes
status	active (default: firing or acknowledged, not snoozed) or resolved
limit	1–500, default 100

Each anomaly has its type, severity, status, title and description, the actual and usual values, and when it was detected.

What the API returns

The API returns exactly what the app shows, under the same rules: the provider-reported costs from your active connections, within your plan's history window. Paused connections aren't included.

Limits and errors

Each token can make 60 requests a minute, and any one IP address 300 a minute across all tokens. Past that, you get 429 Too Many Requests; wait a minute and retry.

Status	Meaning
401	The token is missing, mistyped, or has been revoked
403	Your organization is no longer on the Scale plan. Tokens are kept and work again if you move back to Scale
422	A parameter isn't valid, such as a badly formatted date
429	Rate limit reached

Keeping tokens safe

Treat a token like a password: keep it in a secrets manager or environment variable, not in code or a shared spreadsheet. Use a separate token for each tool, so you can revoke one without breaking the others.