Authentication

Every HTTP call carries your API key in the x-gladia-key header:

curl https://eu1.api.gladia.io/v2/live -H "x-gladia-key: $GLADIA_API_KEY"

The WebSocket needs no key: the URL that POST /v2/live returns carries a single-use token for its session.

API keys

Create and revoke keys in Gladia Workspace, under API keys. Keys start with ge_ and are shown once, at creation. A revoked key stops working within 30 seconds.

A key can be restricted to some products (its scopes). The live API needs Real-time STT: a key without it gets a 403 with "error": "api_key_scope_denied". A key without any scope reaches every product.

IP allowlist

A workspace can accept API calls from listed addresses only (Settings → Security). A call from another address gets a 403 with "error": "ip_not_allowed". The allowlist applies to the API, not to Gladia Workspace itself.

Keep the key on your server

Create sessions from your backend and give browsers and phones only the session’s WebSocket URL: it works once, for one session, within 60 seconds, and reveals nothing about your key. The client then streams its audio directly to the API, without going through your servers.

Errors

status	error	meaning
401		no key, or an unknown one
403	api_key_scope_denied	the key lacks the Real-time STT scope
403	ip_not_allowed	the caller’s address is not in the workspace’s allowlist

Every error body has the same shape: Errors.