Introduction

Authentication

For server-side requests, copy the complete Base64 credential from Portal or the CLI into INWORLD_API_KEY. Send it as-is:

Authorization: Basic $INWORLD_API_KEY

For browser and mobile clients, create a token on your backend and send it with Bearer. Prefer one-time tokens for direct TTS, STT, and LLM calls. Direct Realtime clients still use session tokens. Those tokens are deprecated for other new client integrations. Browser WebSockets carry the token in the bearer_ subprotocol.

Use the authentication matrix to choose credentials for your environment. The API key guide explains Base64, authentication rules for token creation, and how to handle invalid credentials or insufficient permissions. See Security best practices for storing credentials and issuing tokens safely.