Skip to content
TutujinAPI

Security & compliance

How accounts and API keys are protected, what data the platform records, and where each group's route comes from.

Account and access security

  • Two-factor (TOTP)

    Once enabled, sign-in asks for a code from your authenticator app as well as your password.

  • Passkeys

    Sign in with your device's fingerprint, face or a hardware security key.

  • Session management

    See which sessions are signed in and revoke any you don't recognize.

  • Personal access tokens

    Scoped tokens give scripts only the permissions they need.

  • Audit log

    Sign-ins and security changes are recorded, and you can review your own records in the console.

  • Encryption in transit

    HTTPS throughout, and sign-in passwords are encrypted in the browser before they are sent.

  • Rate limiting

    API requests are rate limited to prevent abuse.

API key controls

Every API key can be locked down on its own. Use one key per project and environment.
  • Spending cap
  • Expiry date
  • Model allowlist
  • IP allowlist
  • Assigned group

Keep keys on the server, never in web or app front-end code. If you suspect a leak, disable or delete the key in the console and create a new one.

What the platform records

This is what the platform records under its default configuration.

Usage logs record (one entry per call)

  • Time of the call
  • Model name
  • Group
  • API key name
  • Input, output and cache token counts
  • Cost
  • Latency
  • Whether the response was streamed
  • Request ID

Usage logs do not record

  • Request bodies, i.e. what you send to the model
  • Response bodies, i.e. what the model returns
  • The caller's IP address (not recorded by default)
Audit log
Sign-ins and security changes record the time, IP address and browser information (user agent), for account security investigations.
Asynchronous tasks
Asynchronous jobs such as video generation store the task status and returned result so you can check progress and fetch the output.
Forwarding
To generate a response, your request is forwarded to the model provider behind the group you chose. How each provider handles data is governed by its own policies, and we can't make promises on its behalf.

Full details are in the Privacy Policy.

Route sources, labelled as they are

One model often has several routes. Every group is labelled by source, and groups that include non-official sources say so in their notes.
  • OfficialRelays the model vendor's own official API7 groups
  • CloudOfficial model service from a cloud provider, such as Azure OpenAI2 groups
  • Mixed sourcesMixed sources including non-official ones, usually cheaper6 groups

If the source matters for your use case, choose an Official or Cloud group.

All 18 groups

  • StandardLowest priceMixed sources603 modelsCovers every model at the lowest price; some GPT and Claude routes are non-official
  • AzureCloud116 modelsMicrosoft Azure OpenAI — official, well priced, enterprise-grade
  • Azure PlusCloud135 modelsPremium Azure OpenAI line with o-series reasoning models
  • OpenAI DirectOfficial169 modelsOpenAI's own API
  • OpenAI Direct PlusOfficial174 modelsThe fastest, steadiest OpenAI line, incl. o-series and realtime
  • Official · EnterpriseOfficial309 modelsEnterprise line at official list prices, sourced from OpenAI and Anthropic, stability first
  • Claude DirectOfficial47 modelsAnthropic's own API; new models may have limited concurrency at launch
  • Claude List PriceOfficial47 modelsAnthropic official line billed at list price
  • Claude PlusMixed sources40 modelsCost-effective Claude line; includes non-official sources, prices may change
  • Claude LiteMixed sources27 modelsThe cheapest Claude line, non-official sources
  • Gemini PlusOfficial70 modelsGoogle Gemini official line with video understanding
  • Gemini High TierOfficial70 modelsHigher-quota Google Gemini official line
  • China ModelsLowest price—195 modelsDeepSeek, Qwen, Kimi, GLM, MiniMax and more at special prices
  • China Models 2—18 modelsBackup line for Chinese models
  • Economy (per token)Mixed sources42 modelsNon-official sources, billed per token at a discount
  • Economy (per call)Mixed sources54 modelsNon-official sources, billed per call — good for long prompts
  • Stable Diffusion—5 modelsStable Diffusion image models
  • Video Line 1Mixed sources6 modelsVeo and Grok video generation; non-official sources

Content rules

Use of the service must follow the Acceptable Use Policy and applicable law, as well as the usage policies of the model providers you call.

If you use the service to offer generative AI services to the public in mainland China, you must meet the legal obligations that apply, such as algorithm filing, security assessment and labelling of generated content.

When we find a violation, we may restrict, suspend or terminate the API keys or accounts involved.