# Authentication

Every HTTP call carries your API key in the `x-gladia-key` header:

```bash
curl https://eu1.api.gladia.io/v2/live -H "x-gladia-key: $GLADIA_API_KEY"
```

The WebSocket needs no key: the URL that [`POST /v2/live`](/api-reference/v2/live/init/) returns carries a
single-use token for its session.

## API keys

Create and revoke keys in **Gladia Workspace**, under **API keys**. Keys start with `ge_` and are shown once, at
creation. A revoked key stops working within 30 seconds.

A key can be restricted to some products (its **scopes**). The live API needs **Real-time STT**: a key without it
gets a `403` with `"error": "api_key_scope_denied"`. A key without any scope reaches every product.

## IP allowlist

A workspace can accept API calls from listed addresses only (**Settings → Security**). A call from another address
gets a `403` with `"error": "ip_not_allowed"`. The allowlist applies to the API, not to Gladia Workspace itself.

## Keep the key on your server

Create sessions from your backend and give browsers and phones only the session's WebSocket URL: it works once,
for one session, within 60 seconds, and reveals nothing about your key. The client then streams its audio directly
to the API, without going through your servers.

## Errors

| status | `error` | meaning |
|---|---|---|
| `401` | | no key, or an unknown one |
| `403` | `api_key_scope_denied` | the key lacks the Real-time STT scope |
| `403` | `ip_not_allowed` | the caller's address is not in the workspace's allowlist |

Every error body has the same shape: [Errors](/api-reference/#errors).