Authentication

Create workspace credentials, understand permissions, and manage the key lifecycle.

Create and Use a Key

API keys authenticate server-side requests within one workspace. Follow the quickstart to create one in the dashboard. Workspace owners, admins, and developers can create keys.

Give each application or environment its own key. Set an expiration and optional spending or rate limit, then copy the secret into your server’s secret store. The full secret is shown only when the key is created; later listings show metadata and a prefix.

Send the key in the Authorization header:

Authorization: Bearer YOUR_WORKSPACE_KEY

A key’s workspace owns the request and its usage. Passing another workspace ID does not transfer that ownership. Provider credentials are managed by AudioLab; these examples use an AudioLab key, not a provider key.

Understand Key Scopes

A valid key must also have the scope required by the endpoint. The dashboard assigns the scopes available for your deployment when it creates a key and displays them in the permissions column.

Scope	Used For
`models.read`	Listing providers and endpoints; the model list needs no key
`audio.write`	Speech, transcription, and conversational audio
`requests.read`	Reading permitted request records and logs
`usage.read`	Reading usage
`llm.write`	Text and embedding requests
`images.write` / `videos.write`	Enabled image and video generation
`moderation.write` / `ocr.write` / `rerank.write`	Enabled moderation, OCR, and reranking
`inference.write`	Enabled native inference tasks

The endpoint reference identifies the required authentication. A scope grants permission; it does not activate a disabled product or model. If a needed scope is unavailable, confirm deployment access with your workspace administrator.

Dashboard Sessions and Workspace Roles

Signing into the dashboard creates a user session. That session is used for workspace administration, credit management, and named-router configuration. Inference API keys do not replace a dashboard session for these operations.

Workspace roles control what signed-in users can do. For example, a viewer can inspect permitted data but cannot create keys. Use the dashboard for these workflows unless you are explicitly implementing the session-authenticated operations in the reference.

Separate Environments

Keep production and development credentials separate. Use separate workspaces when you need separate balances, settings, or request history, and keep each environment’s key paired with its API origin.

A key named “test” does not make inference free or simulate a provider. Requests still use the target deployment and workspace credits. Customer-supplied provider credentials are not part of this setup.

Browser and mobile applications should call your own backend. Keep the AudioLab key there, and apply your application’s authentication and limits before forwarding a request.

Rotate or Revoke a Key

Create a replacement key in the same workspace.
Update the application’s secret and deploy the change.
Verify a request with the new key.
Revoke the old key from API Keys.

Revocation prevents further use of the key and cannot be undone. If you lose a secret, create a replacement; it cannot be retrieved from the key list. For troubleshooting, record request IDs instead of authorization headers.