X-TKN Terms of Service

Last Updated: October 21, 2026

These terms govern your use of X-TKN, a one-time secret and token API operated by Fennec LLC ("Fennec", "we", "us"). They cover the API at api.x-tkn.com, the account console and retrieval pages at x-tkn.com, the published client libraries, and any MCP interface we expose.

They do not cover the Fennec Studio print-on-demand storefronts. Each of those stores publishes its own terms at its own domain.

By creating an account, calling the API, or using a client library, you agree to these terms and to the Acceptable Use Policy, which forms part of them.

1. What the service does

You send us a payload. We mint a 256-bit token code, return it once, and store a hash of it. A token can be redeemed until it expires, reaches its use limit, or is revoked. A secret token can be retrieved by anyone holding its code; any other token is redeemed only with your account's API key. For one-time secrets, the first successful retrieval consumes the token and no later retrieval succeeds.

Three properties are worth stating plainly, because they are unusual and because they determine what you can expect from us when something goes wrong.

We return a token code exactly once. The code is returned by the create call and nowhere else. We store sha256(code) and not the code, so no later read, redeem, revoke, or update can hand it back. If you do not capture it at creation, it is gone.

We cannot read an encrypted payload, and neither can anyone who compromises us. Where you encrypt before the payload reaches us, the key is either in a URL fragment that browsers never transmit, or in your own keystore. We hold neither. This is a property of the design, not a promise about our staff.

Retrieval is destructive by design. A one-time secret is consumed when it is read. We cannot un-read it, restore it, or tell you what it contained.

1.1 Payloads arrive encrypted, and we hold no key

Every payload must reach us already encrypted, in one of two envelope forms: the xtkn.v1 format we publish, or ciphertext from your own scheme under the xtkn.v1r prefix. The API refuses anything else rather than storing it. We check an envelope's shape and store it as sent. We do not encrypt or decrypt it, and we hold no key that could.

Shape is all we can check. A v1r envelope is stored without inspection, so readable data you wrap in one is stored as readable data. What we promise is that we hold no key, not that every byte you send us is ciphertext.

In the console, your browser does the encrypting. A secret created through the account console at x-tkn.com is encrypted in your browser before it is sent, and the key is placed in the link fragment rather than in any request.

Where you use browser-side encryption on a page we serve — which is every secret created in the console — you are trusting us not to serve code that captures your key on that page load. That trust boundary is smaller than trusting our database, and it is not zero. We describe it in full on our Security page.

2. Accounts

2.1 Signing up

You must give a valid email address you control. Signing up by email is protected by reCAPTCHA and refuses disposable-address providers. You are responsible for everything that happens under your account and for keeping your API keys secret.

You must be at least 18 and legally able to enter a contract. If you sign up for an organisation, you confirm you are authorised to bind it.

2.2 Sandbox accounts

We issue sandbox accounts through an unauthenticated endpoint so an agent or script can get a working key without an inbox. Sandbox accounts are capped at 100 operations and expire 24 hours after creation. A sandbox account can mint secret tokens, but none of its tokens may expire later than the account does. When an unclaimed sandbox account expires we delete it and everything in it. Nothing you put in a sandbox account should be something you need back.

You can convert a sandbox account into a permanent Developer account by claiming it with a verified identity. If the email you claim with already has an X-TKN account under the same sign-in, the sandbox is merged into that account instead: its tokens and API keys move there, the sandbox account is deleted, and its usage and audit history is not carried over. If that email belongs to an account under a different sign-in, the claim is refused. Tokens it minted survive the claim and expire on their own schedule. Its sandbox API key does not outlive the original 24 hours, so create a Developer key for the claimed account.

2.3 API keys

Each plan sets a maximum number of concurrent API keys. Keys can be revoked at any time and revocation takes effect immediately. On Team and above, a key can be pinned to a set of source IP ranges.

Treat a key as a bearer credential granting full access to your account's tokens. A key in a browser bundle is a published key.

3. Plans, quota, and fees

3.1 Plans

The service is sold in three plans: Developer, Team, and Enterprise. What each plan includes, including monthly operation allowances, payload size caps, maximum expiry windows, key and seat counts, audit retention, and which features are available, is published on our pricing page and enforced by the API. We may change plan contents on thirty days' notice. For a paid plan, a change that reduces what you receive lets you cancel without penalty before it takes effect.

3.2 Quota and the overage policy

Passing your monthly allowance does not stop your requests. We keep serving them into a grace band above the allowance, and refuse them only past a defined ceiling, at which point the API returns HTTP 429 until the counter resets at the start of the next calendar month.

Every metered response carries your allowance, your usage, and your ceiling in headers, so your integration can see its position without guessing. We email you when you approach the allowance, when you cross it, and when requests stop.

Separately from monthly quota, we enforce anti-abuse rate limits in a firewall in front of the API, per source IP and per API key. These sit above every plan's allowance and exist to absorb abnormal traffic.

3.3 Fees and billing

Paid plans are billed in advance through Stripe, monthly or annually as you choose. Fees are stated exclusive of tax; you are responsible for any tax other than tax on our income. Payment failures are retried, and we may downgrade the account to Developer if a payment cannot be collected.

Fees are not refundable except where required by law. Cancelling stops the next renewal; it does not refund the current period.

3.4 Trials and automatic conversion

We offer a fourteen-day trial of Team, one per customer, with a payment method required up front.

A trial converts to a paid Team subscription automatically at the end of the trial period, and your payment method is charged. Cancel before the trial ends if you do not want this. If that charge fails, the account keeps Team while the payment is retried, and is downgraded to Developer if it still cannot be collected.

Downgrade to Developer applies Developer's limits immediately. Data retained beyond a shorter plan's retention window may be deleted once the downgrade takes effect.

4. Availability

Developer and Team are provided without an availability commitment. We do not promise uptime, we do not offer service credits, and we are not liable for loss arising from downtime, degraded performance, or maintenance on these plans. We will make reasonable efforts to keep the service running and to give notice of planned maintenance, but that is an intention rather than a term you can enforce.

Enterprise availability is governed by the written agreement for that account. Where that agreement states an uptime commitment, the remedy for missing it is the service credit that agreement specifies, and that credit is your sole and exclusive remedy for unavailability. Absent a signed agreement stating otherwise, the Developer and Team position above applies.

Nothing on any plan makes us liable for a failure caused by your network, your code, a third party you have chosen, or an event outside our reasonable control.

5. Data, deletion, and retention

Our handling of personal data is set out in the Privacy Policy. This section states the contractual position on your content.

5.1 Your content stays yours

You keep all rights in the payloads you send. You grant us only the licence needed to store, transmit, and deliver them as you have instructed. We do not use your payloads to train models, and we could not usefully do so with content we cannot decrypt.

5.2 What deletion means

When you delete a token, or delete your account, we remove the record from our production database rather than flagging it hidden. This is immediate and it is not reversible. Deleting an account deletes its tokens and API keys.

Two carve-outs apply:

  • Legal hold. Where we are subject to a preservation obligation, a court order, or an active legal claim, we will suspend deletion of the affected records for as long as the obligation lasts, and delete them when it ends.

  • Audit records. Audit rows describing what happened to a token deliberately outlive the token. They never contain a token code or a payload. They are retained for your plan's audit retention period and then deleted.

5.3 Finished tokens

A token that is expired, revoked, or has reached its use limit is retained so that a later attempt to use it can be answered accurately rather than as though the token never existed. We may permanently delete a finished token at any time more than thirty days after it finished. Our current sweep deletes them after sixty days of inactivity; that figure is our present practice, not a commitment, and thirty days is the floor you can rely on.

5.4 What we cannot recover

We cannot recover a token code you did not capture, a decryption key you have lost, a secret that has already been read, or anything you have deleted. There is no backup path around any of these, and support cannot make an exception, because the exception would require a capability we deliberately do not have.

6. Acceptable use and suspension

You must comply with the Acceptable Use Policy. We may suspend or terminate an account under that policy, including without prior notice where the conduct appears criminal or presents a risk to others.

Because we cannot inspect encrypted payloads, enforcement operates on account behaviour rather than content. You remain responsible for what you put through the service whether or not we could have detected it.

7. Intellectual property

The service, the API, the documentation, and our marks are ours. Client libraries are licensed under the terms in their own repositories. Nothing here transfers ownership of anything of ours to you, or of anything of yours to us.

You may not copy the service, reverse-engineer it beyond what applicable law permits, or use our marks without permission.

8. Disclaimers

The service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement.

We do not warrant that the service will be uninterrupted or error-free, or that it is suitable for any particular regulatory regime. We make no compliance certification claim we have not published.

9. Limitation of liability

To the maximum extent permitted by law:

  • Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data, even if advised such damages were possible.

  • Our total liability arising out of or relating to these terms is capped at the greater of the fees you paid us in the twelve months before the event giving rise to the claim, or one hundred United States dollars.

  • On Developer, where you pay nothing, that cap is one hundred United States dollars.

Nothing here limits liability that cannot be limited by law.

These limits are a deliberate allocation of risk that the price reflects. If you need a different allocation, that is an Enterprise conversation.

10. Indemnification

You will indemnify and hold us harmless against claims, damages, losses, and reasonable costs arising from the content you put through the service, your breach of these terms or the Acceptable Use Policy, or your infringement of a third party's rights.

11. Term and termination

These terms apply while you hold an account. You may close your account at any time. We may terminate for material breach that is not cured within thirty days of notice, immediately for an Acceptable Use Policy breach, or on thirty days' notice if we discontinue the service.

On termination we delete your data as described in section 5. Sections 5, 7, 8, 9, 10, and 12 survive.

12. Governing law and disputes

These terms are governed by the laws of the State of California, United States, without regard to its conflict of law principles.

The parties will first attempt to resolve any dispute through good-faith negotiation. Failing that, disputes will be resolved by binding arbitration under the rules of the American Arbitration Association. Either party may bring a claim in small claims court instead, and either party may seek injunctive relief in court to protect its intellectual property.

13. Changes to these terms

We may change these terms. Material changes take effect thirty days after posting, and we will notify account holders by email. Continuing to use the service after that date is acceptance. If you do not accept a change, close the account before it takes effect.

14. General

These terms, the Acceptable Use Policy, and the Privacy Policy are the entire agreement between us on this subject, and replace any earlier understanding. Where an Enterprise account has a signed agreement with us, that agreement controls over these terms to the extent they conflict.

You may not assign these terms without our consent. We may assign them to a successor in a merger or sale of assets. If a provision is unenforceable, the rest stands. A failure to enforce a provision is not a waiver of it.

15. Contact

Fennec LLC

Write to support@fennec.studio for legal and contract questions, abuse and security reports, and privacy requests. Starting the subject with "Legal", "Abuse", "Security" or "Privacy" helps us route it.