Skip to main content
All requests to the Lokutor API must be authenticated with an API key.

​
Getting an API key

  1. Sign up at app.lokutor.com
  2. Go to API Keys in the dashboard
  3. Click Create API Key and give it a name
Your key will look like sk_.... Store it securely.

​
Plan limits

An agent minute includes speech recognition, the language model and the voice, on every plan. A minute of a phone call your agent receives counts as three agent minutes, a minute of a call it makes (/callcenter/dial, bulk dial) as six, and each web search as six. /denoise counts against STT minutes. When a limit is reached, requests return 402 (billing.limit_reached); paid plans can turn on overage in the dashboard to continue past agent minutes (2¢ / 1.8¢ / 1.5¢ a minute, up to one extra month’s allowance). Full details at lokutor.com/pricing.

​
Using your API key

Environment variable (recommended):
HTTP headers (REST and WebSocket):
Both headers are accepted on REST requests and on the WebSocket handshake (/ws/tts, /ws/stt, /ws/agent). Sending the key in a header is preferred — it keeps the credential out of URLs, which can be recorded in logs and traces. WebSocket query parameter:
Supported as a fallback for clients that can’t set handshake headers (e.g. browser WebSocket, which has no header API). Prefer the X-API-Key header everywhere else. Short-lived WebSocket tickets (recommended in browsers): rather than putting your key in the socket URL, exchange it for a ticket just before connecting and put the ticket there instead. A ticket opens the same session, reveals nothing about the key, and stops working after 10 minutes, so one that ends up in a console or a log is harmless soon after.
The ticket is accepted anywhere a key is, for as long as it is valid. The exchange itself only takes the key in the Authorization or X-API-Key header, never in the URL. In a browser, mint tickets from your backend so the long-lived key never reaches the page.

​
Security

  • Never commit API keys to version control
  • Use separate keys for development, staging, and production
  • Rotate keys regularly
  • If a key is compromised, delete it from the dashboard and create a new one

​
Multiple environments

Create separate keys for each environment so you can monitor usage independently and revoke keys without affecting other systems.