Secure Browser Setup

browser ──POST /api/lokutor-ticket──▶ your backend ──POST /ws-ticket (key in header)──▶ api.lokutor.com
browser ◀────────── { ticket } ────── your backend ◀──────── { ticket, expires_in } ────
browser ──wss://api.lokutor.com/ws/agent?api_key=wst_…──▶ api.lokutor.com

// server.mjs — LOKUTOR_API_KEY stays on the server
import express from 'express';

const app = express();

app.post('/api/lokutor-ticket', requireSignedInUser, async (req, res) => {
  const r = await fetch('https://api.lokutor.com/ws-ticket', {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.LOKUTOR_API_KEY}` },
  });
  if (!r.ok) return res.status(502).json({ error: 'could not get a ticket' });
  const { ticket, expires_in } = await r.json();
  res.json({ ticket, expires_in });
});

function requireSignedInUser(req, res, next) {
  // Replace with your own session check.
  next();
}

app.listen(3000);

import { VoiceAgentClient } from '@lokutor/sdk';

async function getTicket(): Promise<string> {
  const res = await fetch('/api/lokutor-ticket', { method: 'POST', credentials: 'include' });
  if (!res.ok) throw new Error('No ticket');
  return (await res.json()).ticket;
}

const client = new VoiceAgentClient({
  auth: getTicket,
  agentId: 'your-agent-id', // or prompt / voice / language for an agent defined in code
});

startButton.addEventListener('click', () => client.startManaged());

import { TTSClient } from '@lokutor/sdk';

const tts = new TTSClient({ apiKey: await getTicket() });

const ticket = await getTicket();
const ws = new WebSocket(`wss://api.lokutor.com/ws/agent?agent_id=your-agent-id&api_key=${ticket}`);