Skip to main content
All requests to the Lokutor API must be authenticated with an API key.

​
Getting an API key

  1. Sign up at app.lokutor.com
  2. Go to API Keys in the dashboard
  3. Click Create API Key and give it a name
Your key will look like sk_.... It is shown once, when you create it: copy it then and store it securely. Lokutor keeps only a hash of it, so neither the dashboard nor support can show it again; the dashboard lists each key by its first and last characters (sk_live…a1b2). If you lose a key, delete it and create a new one.

​
Billing and limits

Every key on an account spends the same prepaid balance. Sessions and requests are charged as you use them (a voice agent is 4.2¢ a minute plus the language model by the token, about 5.2¢ a typical minute), and a new session or request needs at least $0.25 of balance. An account can hold 3 sessions at a time before its first top-up and 10 after; higher on request. Rates, top-ups, the welcome credit and the 402 errors are in Pricing and billing.

​
Using your API key

Environment variable (recommended):
Every authenticated endpoint (REST, every WebSocket, and /callcenter/*) accepts the credential in any of three forms: Prefer a header: it keeps the credential out of URLs, which can be recorded in logs and traces. Use the query parameter only where a client cannot set headers, such as the browser WebSocket and EventSource APIs, and there pass a ticket rather than the key.

​
Short-lived tickets

POST /ws-ticket exchanges your API key for a ticket that starts with wst_ and works for 10 minutes. A ticket is accepted anywhere a key is (in any of the three forms above) and can be reused until it expires. It reveals nothing about the key, so one that ends up in a browser console or a log is useless soon after.
The exchange itself takes the key only in the Authorization or X-API-Key header, never in the URL, and a ticket cannot be exchanged for another ticket. In a browser, mint tickets on your backend so the long-lived key never reaches the page; the JavaScript SDK’s auth option fetches a fresh one before every connection. See Secure browser setup.

​
Security

  • Never commit API keys to version control
  • Never put an API key in browser or mobile app code: use tickets
  • Use separate keys for development, staging, and production
  • Rotate keys regularly
  • If a key is compromised, delete it from the dashboard and create a new one

​
Multiple environments

Create separate keys for each environment so you can monitor usage independently and revoke keys without affecting other systems.