Guide · access levels & safety
What an API key is for
Torn's API lets external tools and websites read data from the game on a player's behalf — things
like your stats, your faction's roster, or war activity — without you copy-pasting information by
hand. A key is how the game knows which player is asking and what that request is allowed to see.
Every key is tied to your account, and every request made with it is, as far as Torn is concerned,
something you authorised.
Access levels
Torn keys come in five types, each exposing progressively more (see the
official API wiki page
for the full reference):
- Public — the same information already visible on a player's public profile: name,
level, faction, display case. Low risk; safe to hand to almost anything.
- Minimal Access — adds personal timing information: travel status, cooldowns, work
stats, drug and medicine timers. Not financially sensitive, but it can leak activity patterns —
fine for reminder tools, riskier in the hands of someone who'd exploit knowing when you're
vulnerable.
- Limited Access — a significant step up: battle stats, net worth, money on hand,
reports, stock holdings, and attack history. This is genuinely sensitive data, and it's what most
battle-tracking and war-intelligence tools need in order to function.
- Full Access — everything in Limited Access plus detailed activity logs. The most
revealing tier; reserve it for tools you trust deeply.
- Custom — instead of a fixed tier, you tick the individual data categories a key can
read and nothing else. A well-built tool documents exactly which categories it needs and asks for a
Custom key scoped to just those, rather than reaching for a broad preset.
What the sensitive tiers actually expose
Limited and Full Access keys can see real detail about your account — your battlestats, your money on
hand, your faction's attack log. That's not inherently dangerous (it's exactly what a legitimate
war-intelligence or roster tool needs to function), but it means the trust you place in a key is really
trust in whoever is holding it: how they store it, whether they ever expose it, and what they do with
the data they pull.
What to check before pasting a key anywhere
- Does the request match the tool's purpose? A tool that only needs to confirm your
faction membership has no reason to ask for battlestats or armoury access.
- Is the key stored, or just used in-flight? Reputable tools say explicitly whether
your key is stored (and how — encrypted, and never returned to the browser) or only used for a
single request.
- Can you revoke it? Torn lets you deactivate and regenerate your key at any time
from your account settings. If a tool ever feels off, rotating your key immediately cuts its
access — this is always available and costs you nothing.
- Never share a key over chat, Discord, or forums. Legitimate tools ask you to paste
a key into their own site, not send it to a person. A request to DM your key to "verify" something
is a common scam pattern.
For a deeper breakdown of key safety, see
FFScouter's API key guide.
How this site uses keys
This tool asks for a Custom key scoped to exactly the categories its features need — your own basic
info and battlestats, plus your faction's basic, ranked-war, attack, and chain data — and nothing
else. Keys are encrypted at rest and are never sent back to the browser or shown to other members. See
the Privacy Policy for the full data-handling detail, or a
read-only connection is available if you'd rather not share a full-access key
at all.