> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inworld.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication overview

> How requests to Inworld APIs authenticate: API keys, session tokens, and one-time tokens.

The workspace [API key](https://docs.inworld.ai/portal/api-keys.md) is Inworld's root credential. Two types of short-lived tokens are created from it for code that must not hold the key itself. Use the table below to choose a credential. The [API key authentication guide](https://docs.inworld.ai/portal/api-key-auth.md) explains the exact credential format, header exceptions, and how to recover from errors.

## Pick a credential

| Where your code runs | Credential | Use |
| --- | --- | --- |
| Server or local development | [API key](https://docs.inworld.ai/portal/api-key-auth.md) | Copy the Base64 credential unchanged. Use Basic for direct HTTP requests and keep the key on your server. |
| Direct browser/mobile TTS, STT, or LLM client | [One-time token](https://docs.inworld.ai/portal/ephemeral-tokens.md) | Your backend mints a token for each HTTP request or WebSocket connection attempt. |
| Direct browser/mobile Realtime client | [Session token](https://docs.inworld.ai/portal/session-tokens.md) | Your backend mints a session token. Realtime does not accept one-time tokens. |

SDKs that reuse tokens across requests or reconnects need a refresh flow that supplies a fresh one-time token for every attempt, or a server proxy. See the [existing TTS SDK session-token pattern](https://docs.inworld.ai/tts/node-sdk.md#authentication-with-jwt) for legacy integrations.

**Client code never receives the API key.** Your backend authenticates and authorizes the user before issuing a token, applies per-user limits, and returns only the token fields the client needs. Tokens inherit the parent key's permissions. Use the narrowest suitable key. See [Security best practices](https://docs.inworld.ai/portal/auth-security.md).

## Guides

<CardGroup cols={2}>
  <Card title="API keys" icon="key" href="https://docs.inworld.ai/portal/api-keys.md">
    Create keys, set write permissions, choose Realtime-only keys, and revoke access.
  </Card>

  <Card title="API key authentication" icon="lock" href="https://docs.inworld.ai/portal/api-key-auth.md">
    Learn the header format, where it works, and how to use it.
  </Card>

  <Card title="One-time tokens" icon="bolt" href="https://docs.inworld.ai/portal/ephemeral-tokens.md">
    Single-use, short-lived — the preferred client credential.
  </Card>

  <Card title="Session tokens" icon="clock" href="https://docs.inworld.ai/portal/session-tokens.md">
    Deprecated multi-use JWTs — still used for direct client Realtime sessions.
  </Card>

  <Card title="Security best practices" icon="shield" href="https://docs.inworld.ai/portal/auth-security.md">
    Keep keys out of clients, use a proxy or tokens, and respond to leaks.
  </Card>
</CardGroup>