Short-lived access tokens for TTS, STT and speech-to-speech
Short-lived access tokens for TTS, STT and speech-to-speech
Browser and mobile clients no longer need your API key. Your server calls POST /waves/v1/auth/token with the key and gets back a short-lived access token (prefix wat_, 30 to 900 seconds, default 300). The client sends that token as Authorization: Bearer <token>, or as the api_key query parameter on WebSocket connections.
Tokens work on TTS, STT and speech-to-speech inference routes only: POST /waves/v1/stt/, POST /waves/v1/tts, POST /waves/v1/tts/live, the dedicated Lightning v3.1 routes, the TTS, STT and speech-to-speech WebSockets, and the voice-listing routes. Treat any route outside that list as unavailable to tokens. POST /waves/v1/pulse/get_text, LLM chat completions, voice cloning and minting another token return 403. Usage is billed to the key that minted the token.
What changed
- New API reference page for
POST /waves/v1/auth/tokenwith request, response and error schemas. - New Token-Based Authentication guide, next to Authentication in the API reference, walks through the server mint and client call flow, lists which routes accept a token, and covers expiry, revocation and region behavior.
- The Authentication page’s STT test request now uses the unified
POST /waves/v1/stt/path, which accepts both API keys and tokens.