TorBox API Key: Where to Find It and Keep It Safe

Your TorBox API key lives in your account settings after you log in, and it is the only thing most third-party apps need to act on your account. Treat it like a password. Anyone who has it can add, delete and download items as you. If it leaks, generate a new one and update your apps.

We cannot show a screenshot of the logged-in settings page, so the path below is the general one. If your dashboard looks different, use the search in the help center at support.torbox.app.

Find the key

1. Log in on torbox.app

   Use the account you pay with. The key belongs to that account.

2. Open Settings

   Go to the settings page from the profile menu in the top right.

3. Find the API section

   Look for the API key field. Copy it. There is usually a button to show or hide it and one to create a new one.

4. Paste it into the app

   Paste it only into the app’s own settings screen, never into a chat, a forum post or a screenshot.

What uses the key

The key is used for the API at api.torbox.app, documented at api-docs.torbox.app. Typical uses:

• Media players and library apps with a TorBox option. See our guides for Stremio and the other player pages linked from there.
• Download managers such as JDownloader. TorBox’s help center has integration guides, so check it for the current list.
• Download clients and automation tools that talk to TorBox on your behalf, for example rdtclient. Check the app’s own page before trusting it with a key.
• Scripts and bots you write yourself, using TorBox’s SDKs or plain HTTP.
• WebDAV mounts use your account credentials and are covered in the WebDAV guide.

Each app should say exactly what it needs. If an app asks for your password instead of an API key, stop and read what it does before continuing.

How the key is sent

In the API, the key is sent as an authorisation header with each request, in the form Authorization: Bearer <your key>. Keep it out of URLs where you can, because URLs end up in browser history and logs. Some apps do put keys in links; if one does, treat the whole link as secret.

Keep it safe

• Only paste it into software you trust and whose source or reputation you can check. TorBox itself is not open source, but its SDKs and many tools are.
• Do not post screenshots of your settings page or your app config.
• Do not store it in a public repository or a shared notes file. Use a password manager.
• Use a separate environment variable or secret store in scripts, never hard-coded.
• If you use a media server, check its logs before sharing them. Keys sometimes appear in them.
• Regenerate the key after a suspected leak, then update all apps.

TorBox’s help center says you can use your account from any IP and even share your key, but it also says it will investigate unusually high usage and may ban accounts used unfairly. Sharing with trusted family is one thing. A public key is another. For wider safety questions, see is TorBox safe.

Plan limits still apply through the API

An app using your key is still bound by your plan: slots, per-download size and monthly caps. If an app suddenly stops adding downloads, check your plan limits before blaming the key. Free has 1 slot and 10 downloads per month. Essential has 3 slots, Standard 5, Pro 10. Check the pricing page. And if nothing works at all, see is TorBox down.

Do you need to pay to use the API?

The API is part of the service. Which features an app can reach depends on your plan, for example Usenet is a paid-plan feature (check the plan table). If you are planning to build around the API, a paid plan is more practical, because the free plan is small.

Get the 7 bonus days per month (opens TorBox in a new tab, affiliate link)

If you buy through our link, you get 7 extra days per month purchased. It is a first-purchase bonus, and you must confirm the popup before paying. Once you are set up, the key is a one-time job. Store it somewhere safe and you rarely need to look at it again.

Get the 7 bonus days per month (opens TorBox in a new tab, affiliate link)