Lesson 2 of 12

Service token & auth

When the server is started with the TT_TOKEN environment variable, every API route requires the token. Without it, the first request returns 401 and opens the token modal.

  • Paste the TT_TOKEN value you set when launching the server, then save.
  • The token is kept in the browser's localStorage across sessions.
  • The browser sends it as the X-TT-Token header; manual clients may also use Authorization: Bearer.
  • /api/health is intentionally public so load balancers can probe it — it exposes no sensitive data.
token modal
Security note: never pass the token in a query string — those end up in proxy logs. This build removed that path entirely.
Course index · Lesson 2 of 12
TheTensorTune workbench