Skip to main content
All requests to the Lokutor API must be authenticated with an API key.

​
Getting an API key

  1. Sign up at app.lokutor.com
  2. Go to API Keys in the dashboard
  3. Click Create API Key and give it a name
Your key will look like sk_.... It is shown once, when you create it: copy it then and store it securely. Lokutor keeps only a hash of it, so neither the dashboard nor support can show it again; the dashboard lists each key by its first and last characters (sk_live…a1b2). If you lose a key, delete it and create a new one.

​
Billing and limits

Every key on an account spends the same prepaid balance. Sessions and requests are charged as you use them (a voice agent is 4.2¢ a minute plus the language model by the token, about 5.2¢ a typical minute), and a new session or request needs at least $0.25 of balance. An account can hold 3 sessions at a time before its first top-up and 10 after; higher on request. Rates, top-ups, the welcome credit and the 402 errors are in Pricing and billing.

​
Using your API key

Environment variable (recommended):
HTTP headers (REST and WebSocket):
Both headers are accepted on REST requests and on the WebSocket handshake (/ws/tts, /ws/stt, /ws/agent). Sending the key in a header is preferred — it keeps the credential out of URLs, which can be recorded in logs and traces. WebSocket query parameter:
Supported as a fallback for clients that can’t set handshake headers (e.g. browser WebSocket, which has no header API). Prefer the X-API-Key header everywhere else. Short-lived WebSocket tickets (recommended in browsers): rather than putting your key in the socket URL, exchange it for a ticket just before connecting and put the ticket there instead. A ticket opens the same session, reveals nothing about the key, and stops working after 10 minutes, so one that ends up in a console or a log is harmless soon after.
The ticket is accepted anywhere a key is, for as long as it is valid. The exchange itself only takes the key in the Authorization or X-API-Key header, never in the URL. In a browser, mint tickets from your backend so the long-lived key never reaches the page.

​
Security

  • Never commit API keys to version control
  • Use separate keys for development, staging, and production
  • Rotate keys regularly
  • If a key is compromised, delete it from the dashboard and create a new one

​
Multiple environments

Create separate keys for each environment so you can monitor usage independently and revoke keys without affecting other systems.