Skip to main content

Quick Start Guide

Before you can call the Engine API you need an account, an organization, and an API key — and all three come from the Toolpath API Portal. Accounts, teams, billing, usage, and security live there too. The Engine API itself has no account or key management endpoints, so everything in this guide happens in Portal.

If you have never worked with an API before, read New to APIs? first.

Once you have a key, go on to Authentication to make your first request.

Create an account​

Already have a Toolpath subscription? Sign up with the same email you use for the Toolpath application at app.toolpath.com. Check this before you start: signing up always creates a new organization, so a different address leaves you with two unconnected accounts rather than API access attached to the subscription you already have.

  1. Go to portal.toolpath.com/signup.
  2. Fill in Company, First Name, Last Name, Email, and Password, or use Continue with Google.
  3. Click Create Account.

Creating the account signs you in. The Google path does not ask for a company name — the organization is named after you, and an admin can rename it later on the Team page.

Create an API key​

Go to portal.toolpath.com/keys and click Create API Key. A key is created with a scope:

  • Read & write — the default; may submit and process parts.
  • Read-only — may read parts and job history but not create work.

Allowed browser origins is optional. It only applies to keys used by code running in a web browser — one origin per line. For a script, a server, or anything else that is not a browser, leave it empty.

The complete key is shown once, when it is created. Copy it then — Portal cannot show it again. Keys begin with tp_; the fragment shown in the listing afterwards is an identifier and cannot be used to authenticate.

Paste it straight into a password manager. The point is that the key lands somewhere encrypted the moment you copy it, rather than in a note app, a text file, or an email to yourself. If teammates need the same key, share it through the password manager's shared vault rather than over chat or email.

That is where the key is kept. It is not where your code should read it from — see Authentication for that.

To replace a key you have lost or want to rotate, use Regenerate key in its row menu. That issues a new secret on the same key and shows it once, in the same way; the old secret stops working. Revoke key in the same menu ends a key's access for good.

Only organization admins can create, regenerate, or edit the origins of a key. Any member can revoke one.

Invite teammates​

Invite people from the Team page with Invite Teammate. Only people who need to generate and distribute API keys need an account here — the Engine API authenticates with the key alone, so the developers and services that use a key do not each need to be team members.

Teammates are invited as member or admin.

Members get a read-only view of the shared account. They can see the team's API keys and the organization's usage, and they can revoke a key — the one change they can make, so that anyone who notices a leaked key can shut it off immediately. Apart from their own account and security settings, nothing else is theirs to change: they cannot issue keys, manage people, or open the Billing page, which is hidden from them entirely.

Admins can do all of that plus create, regenerate, and edit keys; invite and remove teammates and change their roles; manage billing; and set the organization's security policy.

Two-factor authentication​

Enable 2FA from the Security page: under Two-Factor Authentication, click Set Up, scan the QR code with an authenticator app, and confirm the code. Save the backup codes it shows you — they are shown once.

Admins can also turn on Require Two-Factor Authentication for the whole organization, which is forced on for ITAR organizations. This has a consequence worth knowing before you turn it on: when an organization requires a second factor, a member who has not enrolled cannot create keys, and keys they already created are refused by the Engine API with two_factor_required. Enrolling on the Security page restores them. Enroll the people who hold your keys before requiring it of the team.

Usage and billing​

Progress against your credit limits is on the Usage page, along with recent requests by endpoint and status. Requests appear there once your keys are used. Plan and payment details are on the Billing page.