Security, data and content rules
How keys are separated, what the platform records about your calls, the rate limits, and what you may not use the models for.
Separate keys for suppliers and users
Suppliers' original API keys are held on the platform and are never shown to users. You call models with a token that FishToken issues to you. The two sets of keys are kept apart, so neither side can see the other's credentials.
What is recorded about your calls
FishToken records call metadata, such as the model, token counts and time, for billing and logs. The content of your requests (for example, your messages and prompts) is not stored by the platform.
To answer a request, FishToken forwards it to the upstream model service that serves the model you chose. That service processes the request under its own terms. See the Privacy Policy for details, including cross-border processing.
Rate limits
60 requests per minute for standard accounts and 120 requests per minute for accounts that have topped up. If you hit the limit, back off and retry.
Protecting your API key
- Keep keys on your server or in environment variables, never in browser or app code.
- Use separate keys for separate projects so you can revoke one without stopping the others.
- If a key leaks, delete it in the console and create a new one. Losses caused by a key you leaked are your responsibility.
Content rules
Content filtering depends on the upstream model service, and some requests may be refused by it. Filters do not catch everything, so these rules apply to everything you generate through FishToken, whatever a filter allows.
Not allowed
- Sexual or pornographic content, and any sexual content involving minors.
- Graphic violence, gore, or content that promotes violence, terrorism or self-harm.
- A real person's face, body or voice without their consent, including deepfakes of public figures.
- Content that infringes copyright, trademarks or other rights.
- Fraud, scams, deceptive ads or impersonation.
- Anything illegal where you or your audience are, or that breaks the upstream model service's terms.
Your responsibilities
- Review generated content before you publish it.
- Label AI-generated content where the platform you publish on or local law requires it.
- Follow the advertising rules of the channels you run ads on.
Requests that break these rules may be refused, and accounts used for them may be suspended.
Report a problem
To report a security issue or misuse, email support@fishtoken.ai. Never send your API key by email.