A token is your account, outside the browser. generate.mjs, pull.mjs, the /generate skill in Claude Code, or any script sends it as a Bearer header, and the wall treats the call as you: generations queue on your Kie and fal keys, results land here, picks pull down into a site folder. It is not a provider key and it spends nothing by itself.

1. Label it by machine (macbook, ci) and press New token. It shows once; revoke it here when that machine goes.
2. Paste the two lines it prints into trustpix/.env (gitignored).
3. Check with node generate.mjs --list-models; then --quote before every spend.

For an AI agent, hand it /docs/api.md: every endpoint, the item shape, the scripts and the spending rules. /llms.txt points there too.