Why does the Toxly API return 401?

A 401 response usually means the X-Toxly-Key header is missing, invalid, revoked, or copied incorrectly.

Why does the Toxly API return 429?

A 429 response means the API key hit a per-minute rate limit or the project hit its monthly request limit.

What should I include in a Toxly support ticket?

Include project name or ID, request ID, approximate time, endpoint, status code, and a short summary. Do not send full API keys, passwords, reset tokens, or payment details.

Help Center

Fix common Toxly issues faster.

Find the right API endpoint, debug moderation responses, check limits, and prepare useful support details without sharing secrets.

Create ticket Read docs

API requests

401, 429, request body, headers, and endpoint checks.

Moderation results

Decisions, scores, categories, policies, and logs.

Discord bot

OAuth, server setup, channels, actions, and bot permissions.

Billing and limits

Plans, request limits, Stripe portal, and project usage.

API

Request does not work

Quick checks

Use https://api.toxly.net/v1/moderate/text.
Send Content-Type: application/json.
Send the API key in X-Toxly-Key.
Make sure the selected key is active and belongs to the right project.
Do not call Toxly directly from frontend code with a private key.

Status codes

400Invalid JSON or missing text.

401Missing, invalid, or revoked API key.

403Project or account is disabled.

413Request body is too large.

429Rate limit or monthly limit reached.

Moderation

Understanding a result

Decision

allow, warn, review, block, mask, or escalate. Your app decides what to do with that decision.

Risk score

A value from 0.0 to 1.0. Higher scores usually mean stronger policy risk. Policies convert scores into actions.

Logs

Toxly stores previews and hashes, not the full original text. Use request IDs for debugging and support.

If a result looks wrong, test the same text in the project test console, compare the policy thresholds, and include the request ID when contacting support.

Dashboard

Project setup checklist

Create a project.Projects keep keys, policies, logs, Discord settings, and usage separate.
Create an API key.Copy the full key once. Toxly only shows the prefix later.
Run a test.Use the test console before connecting production traffic.
Review logs.Check decisions, categories, latency, and matched rules.
Adjust policy thresholds.Use stricter thresholds for high-risk products and communities.

Discord

Discord bot troubleshooting

Bot is not reacting

Confirm the bot is in the selected server.
Check that Toxly has permission to read messages and moderate members.
Choose an active API key in Discord setup.
Make sure the channel is not ignored.
Check the action chips for warn, review, block, and escalate.

Logs are missing

Select a mod or log channel from the setup page.
Enable Mod log, Log, or Review log in actions.
Verify the bot can send messages in the channel.

Billing

Plans, limits, and invoices

Free1,000 requests per month. Good for testing.

Starter50,000 requests per month for early production apps.

Pro250,000 requests per month for growing teams.

Scale1,000,000 requests per month and higher rate limits.

EnterpriseCustom limits, rollout help, and priority support.

Open Billing in the dashboard to change plans or view the Stripe customer portal.

Support

What to include in a ticket

Send this

Project name or project ID.
Request ID, if available.
Approximate time and timezone.
Endpoint, status code, and short error summary.
Visible API key prefix only, never the full key.

Do not send

Full API keys, passwords, or reset tokens.
Large dumps of private user content.
Payment card details.

Create support ticket