Getting started

Authentication

API keys, headers, and keeping keys out of the browser.

When the server is configured with keys (API_KEYS), every /api/v1 request must carry one, in either header:

Authorization: Bearer YOUR_API_KEY

A missing or wrong key returns 401 unauthorized. /health stays open for orchestrators.

Keep keys server-side

A key in a public web bundle is a public key. Record in the browser, send the audio to your own backend, and call the Voice API from there.

Key management is planned

Today keys are static values configured on the server. Per-workspace keys, rotation and revocation are on the roadmap; the dashboard shows the planned interface with sample data.