Authentication

The API base URL is https://api.p99lab.com (streaming: wss://api.p99lab.com). Your key is in the console.

HTTP requests

Send the key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

File requests also accept an X-API-Key header:

X-API-Key: YOUR_API_KEY

A request without a key gets 401. GET /healthz needs no key.

WebSocket streams

Send the Authorization: Bearer header on the WebSocket handshake. Where your client cannot set headers (a browser, or Node's built-in WebSocket), put the key in the key field of the first message instead:

{ "key": "YOUR_API_KEY", "language": "en", "sample_rate": 16000 }

An unknown key ends the session with an error message: unknown API key.

Managing keys

Create and revoke keys in the console under API keys. An account can have up to 10 active keys. A key is shown in full only once; afterwards the console shows its first characters so you can tell keys apart. A revoked key stops working within a minute.

Keeping keys safe

• Call Audrey from your server, not from code that ships to a browser or an app.
• Keep keys in environment variables or a secret manager, never in source control.
• Use a separate key for each environment, so you can revoke one without touching the others.
• If a key may have leaked, revoke it in the console and create a new one.