Authentication

API key authentication

Authenticate server-side requests directly with your API key.

API key authentication sends your key directly in the Authorization header. It is the simplest way to call Inworld APIs and the right choice for anything that runs on your servers.

The API key is for server-side code only. Never use it in browsers, mobile apps, or game builds — mint a token for those instead. See Security best practices.

The header

Use the key you copy from Inworld Portal or the Inworld CLI as-is:

Authorization: Basic $INWORLD_API_KEY

For example:

bash

curl https://api.inworld.ai/tts/v1/voices \
  --header "Authorization: Basic $INWORLD_API_KEY"

Where it works

The platform APIs accept direct API key authentication: TTS, STT, LLM, Voices, Realtime, and the one-time token mint. WebSocket endpoints accept the same header on the connection request. The one exception is the session token mint, which authenticates with a signed request instead of the plain header.

Store the key as an environment variable or in a secret manager, and read it at runtime — see Security best practices for handling rules and what to do if a key leaks.