Skip to content
TutujinAPI

Security & compliance

How accounts and API keys are protected, what data the platform records, and where each group's route comes from.

Account and access security

Sign-in, sessions and API calls each have their own safeguard.

  • Two-factor (TOTP)

    Once enabled, sign-in asks for a code from your authenticator app as well as your password.

  • Session management

    See which sessions are signed in and revoke any you don't recognize.

  • Personal access tokens

    Scoped tokens give scripts only the permissions they need.

  • Audit log

    Sign-ins and security changes are recorded, and you can review your own records in the console.

  • Encryption in transit

    HTTPS throughout, and sign-in passwords are encrypted in the browser before they are sent.

  • Rate limiting

    API requests are rate limited to prevent abuse.

API key controls

Every API key can be locked down on its own. Use one key per project and environment.

Keep keys on the server, never in web or app front-end code. If you suspect a leak, disable or delete the key in the console and create a new one.

sk-••••••••••••Every key can be set on its own
  • Spending cap
  • Expiry date
  • Model allowlist
  • IP allowlist
  • Assigned group

What the platform records

This is what the platform records under its default configuration.

Audit log
Sign-ins and security changes record the time, IP address and browser information (user agent), for account security investigations.
Asynchronous tasks
Asynchronous jobs such as video generation store the task status and returned result so you can check progress and fetch the output.
Forwarding
To generate a response, your request is forwarded to the model provider behind the group you chose. How each provider handles data is governed by its own policies, and we can't make promises on its behalf.

Full details are in the Privacy Policy.

Usage logs record (one entry per call)
  • Time of the call
  • Model name
  • Group
  • API key name
  • Input, output and cache token counts
  • Cost
  • Latency
  • Whether the response was streamed
  • Request ID

Usage logs do not record

  • Request bodies, i.e. what you send to the model
  • Response bodies, i.e. what the model returns
  • The caller's IP address (not recorded by default)

Route sources, labelled as they are

One model often has several routes. Every group is labelled by source, and groups that include non-official sources say so in their notes.

  • OfficialRelays the model vendor's own official API7 groups
  • CloudOfficial model service from a cloud provider, such as Azure OpenAI2 groups
  • Mixed sourcesMixed sources including non-official ones, usually cheaper6 groups

If the source matters for your use case, choose an Official or Cloud group.

All 18 groups
  • StandardLowest priceMixed sources618 modelsCovers every model at the lowest price; some GPT and Claude routes are non-official
  • AzureCloud116 modelsMicrosoft Azure OpenAI — official, well priced, enterprise-grade
  • Azure PlusCloud135 modelsPremium Azure OpenAI line with o-series reasoning models
  • OpenAI DirectOfficial169 modelsOpenAI's own API
  • OpenAI Direct PlusOfficial174 modelsThe fastest, steadiest OpenAI line, incl. o-series and realtime
  • Official · EnterpriseOfficial309 modelsEnterprise line at official list prices, sourced from OpenAI and Anthropic, stability first
  • Claude DirectOfficial47 modelsAnthropic's own API; new models may have limited concurrency at launch
  • Claude List PriceOfficial47 modelsAnthropic official line billed at list price
  • Claude PlusMixed sources40 modelsCost-effective Claude line; includes non-official sources, prices may change
  • Claude LiteMixed sources27 modelsThe cheapest Claude line, non-official sources
  • Gemini PlusOfficial70 modelsGoogle Gemini official line with video understanding
  • Gemini High TierOfficial70 modelsHigher-quota Google Gemini official line
  • China ModelsLowest price—195 modelsDeepSeek, Qwen, Kimi, GLM, MiniMax and more at special prices
  • China Models 2—18 modelsBackup line for Chinese models
  • Economy (per token)Mixed sources42 modelsNon-official sources, billed per token at a discount
  • Economy (per call)Mixed sources54 modelsNon-official sources, billed per call — good for long prompts
  • Stable Diffusion—5 modelsStable Diffusion image models
  • Video Line 1Mixed sources6 modelsVeo and Grok video generation; non-official sources

Content rules

Using the service means following our rules, the law and the model providers' policies.

  • Rules and policies

    Use of the service must follow the Acceptable Use Policy and applicable law, as well as the usage policies of the model providers you call.

  • Public services in China

    If you use the service to offer generative AI services to the public in mainland China, you must meet the legal obligations that apply, such as algorithm filing, security assessment and labelling of generated content.

  • Enforcement

    When we find a violation, we may restrict, suspend or terminate the API keys or accounts involved.