Authentication
Bearer token or x-api-key header.
Draft notice
Owner check needed: endpoint, parameter, limit and error names here come from the planning spec, not from the live service. Confirm them against the real API before launch.
Overview
Send your API key on every request. Keys are created in the dashboard and shown once.
- Bearer token or x-api-key header.
- Keep keys on your server.
- Bad key: 401, 0 credits.
Authorization: Bearer tta_your_key
x-api-key: tta_your_keySend the key
Use either header. Both carry the same key.
The tta_ prefix is what the local mock uses; the real key format is to be confirmed.
Keep keys private
- Store the key in an environment variable or a secrets manager, never in client-side code or a repository.
- Call the API from your server. A key in a browser can be copied by anyone who opens the page.
- Rotate a key from the dashboard if it leaks.
What a bad key returns
A missing or wrong key returns HTTP 401 with unauthorized. It costs 0 credits.
Next: the transcript endpoint.
Ready to call it from your code?
Get API key