Introduction

Authentication

For server-side requests, set INWORLD_API_KEY to the complete Base64 credential copied from Portal or the CLI, and send it as-is:

Authorization: Basic $INWORLD_API_KEY

Browser and mobile clients use a backend-minted token under Bearer: prefer one-time tokens for direct TTS, STT, and LLM calls. Direct Realtime clients still use session tokens, despite their deprecation for other new client integrations. Browser WebSockets carry the token in the bearer_ subprotocol.

The authentication matrix covers each environment. The API key guide explains Base64, the token-mint exceptions, and recovery from invalid credentials or insufficient permissions. See Security best practices for safe storage and token issuance.