Keys are prefixed with itk_ (inTouch key) followed by 64 hex characters, so
they are easy to spot in logs and secret scanners.
Property
Value
Header
X-API-Key (or x-api-key)
Format
itk_ + 64 hex characters
Keys per user
Exactly one — generating a new key replaces the old one
Expiry
None; valid until rotated
Scope
All capabilities, for that one account
Where the key comes from
Only the account owner can create a key, and only from inside the app:
Settings → App & Media → inTouch API. The screen shows the current key,
a copy button and a rotate button.
There is no endpoint on this API that mints keys. That is deliberate — key creation stays
behind the app's own login.
Rotating a key
Tapping Generate new key in the app deletes the existing key and issues a new one.
The old key stops working immediately and every integration holding it starts getting
403. Rotate when a key leaks, or when you stop using a tool you gave it to.
Header sent, but the key is unknown or was rotated away
Error strings are German — they come straight from the backend and are
meant for developers, not end users. Match on the status code, not the text.
What the key does and does not reach
This documentation covers the endpoints an external tool may call. The app itself talks to
many more routes on the same backend; those are not part of this API and are not
key-authenticated.
Endpoint
Key required
POST /api/addons/recipe/suggest
Yes
GET /api/addons/recipe/history
Yes
GET /api/addons/vocab/profile
Yes
POST /api/addons/vocab/push
Yes
GET /api/addons/vocab/history
Yes
# intouch api
base https://api.in-touch.cc
auth X-API-Key: itk_<64 hex> one key per user, no expiry, no scopes
docs https://docs.in-touch.cc
format every response is JSON and carries "success"
# authentication
One personal key per inTouch account. No OAuth, no scopes, no expiry dates.
# header
X-API-Key: itk_3f9c1a0e7b42d85c6109fe23ab7d4410c8e5b6d29f01a374bc58e6d7f2093a1b
header X-API-Key (x-api-key is accepted too)
format itk_ + 64 hex characters
keys per user exactly one - generating a new one replaces the old one
expiry none, valid until rotated
scope all capabilities, for that one account
# where the key comes from
inTouch app > Settings > App & Media > inTouch API.
The screen shows the current key, a copy button and a rotate button.
No endpoint on this API mints keys: key creation stays behind the app login.
# rotation
"Generate new key" deletes the existing key and issues a new one.
The old key stops working immediately -> every integration holding it gets 403.
Rotate when a key leaks or when a tool that had it is no longer used.
# failures
401 {"success":false,"error":"X-API-Key Header fehlt"}
no header was sent at all
403 {"success":false,"error":"Ungültiger API-Key"}
header sent, but the key is unknown or was rotated away
Error strings are German and come straight from the backend.
Match on the status code, never on the message text.
# endpoints that require the key
POST /api/addons/recipe/suggest
GET /api/addons/recipe/history
GET /api/addons/vocab/profile
POST /api/addons/vocab/push
GET /api/addons/vocab/history
The app itself talks to many more routes on the same backend. Those are not
part of this API, are not key-authenticated, and must not be called.
# pages
/ overview, capability list
/quickstart get a key, first request
/authentication key format, rotation, failure modes
/conventions envelope, status codes, limits, dates
/recipes recipes capability
/vocabulary vocabulary capability
/roadmap capability anatomy, what is planned
every page is also plain text: append .txt (e.g. https://docs.in-touch.cc/vocabulary.txt)
all pages at once: /llms.txt (index) and /llms-full.txt (everything)
# for agents
- Use only the endpoints listed here; do not invent paths, fields or values.
- Check "success" in the body, not just the HTTP status.
- Error strings are German and developer-facing; branch on the status code.
- Batches are accepted partially: read "rejected" and "errors[].index".
- Dates are UTC. Calendar days are YYYY-MM-DD, timestamps are ISO 8601.
- The API key is a credential: never log it, never pass it to a third party.
- Ask the user before writing content into their app for the first time.