) before the closing tag on any HTML, WordPress, Shopify, or React website."}},{"@type":"Question","name":"Is ToolsWallet RAG free to use?","acceptedAnswer":{"@type":"Answer","text":"Yes! Every developer account gets 2 permanently free Knowledge Bases (RAGs) with up to 25 records each, real-time streaming SSE API, and 1-line embeddable widgets with zero credit card required."}}]}]}
ToolsWallet RAG documentation v1.0. Learn how to build custom knowledge assistants with zero cost. ToolsWallet Platform
DocumentationAPI Keys & Security
3 min readAugust 2026
Security

API Keys & Domain Security

Try in Console

API keys authenticate your client websites, mobile apps, and backend services. Every key is encrypted with SHA-256 and protected with origin whitelisting.

Generating API Keys

Go to Dashboard > API Keys tab. Click 'Generate New API Key'. Enter a friendly label (e.g. 'Production Website Widget') and specify allowed origins.

CORS Domain Whitelisting

When embedding chat widgets on public websites, set allowed origins (e.g. https://mycompany.com). If an unauthorized domain tries to use your API key, our server automatically blocks the request with a 403 Forbidden response.

SHA-256 Storage Security

Raw API keys (tw_rag_live_...) are shown only once upon creation. Our database only stores the SHA-256 cryptographic hash. Even if our database were compromised, your raw keys cannot be extracted.

Revoking Keys

You can instantly deactivate or revoke any key from the API Keys table with 1 click. Revoked keys stop working immediately across all endpoints.

Ready to build your Custom RAG?
Deploy in under 3 minutes with 2 free RAG knowledge bases.
Create Free RAG