API Keys & Scopes

Every API key carries a set of scopes — permissions of the form resource:permission — and can only do what its scopes allow. A key for a soundboard app might get lines:read and sfx:read only; a build pipeline that generates dialogue might add tts:generate and lines:write. Grant only what each integration needs.

Keys authenticate the v1 REST API, the MCP server, and the Public TTS API.

write always includes read for the same resource.

1. 1Go to API Keys and choose New API Key.
2. 2Name the key after the integration that will hold it ("Game build pipeline", "Support bot").
3. 3Tick the permissions it needs — one row per resource with Read/Write checkboxes. At least one is required.
4. 4Copy the key and store it in your secret manager. Treat it like a password.

Existing keys can be disabled (temporarily blocks all use), have their permissions edited at any time (takes effect immediately), or be deleted permanently.

Send the key with every request, preferably in the Authorization header:

# Preferred
curl -H "Authorization: Bearer $API_KEY" https://<host>/api/v1/verify

# Also accepted
curl -H "X-API-Key: $API_KEY" https://<host>/api/v1/verify

{
  "success": true,
  "result": {
    "keyId": "…",
    "name": "Game build pipeline",
    "organizationId": "…",
    "scopes": ["tts:generate", "lines:write", "lines:read"],
    "status": "active"
  }
}

All v1 errors use the response envelope:

{ "success": false, "errors": [{ "code": "missing_scope", "message": "API key is missing the required scope: lines:write" }] }