Authentication

Every endpoint except /corpus requires a key.

curl https://clips.vocaflare.com/v1/words/receive/clips \
  -H "Authorization: Bearer vfc_live_9f2c..."

A missing or unknown key gets 401 with error.code set to invalid_key. A key that exists but is disabled gets the same code, so a client cannot tell the two apart; your dashboard can.

Keys are server-side

A key identifies your account and spends your quota. Anything shipped to a device or a browser is readable by anyone holding it, so keys belong on your server, behind your own endpoint.

If your product is a mobile app or a static site, proxy the call: your backend holds the key, applies your own per-user limits, and caches the response. You need that cache anyway, see Caching.

One key per environment

Ask for separate keys for staging and production. Usage is reported per key, so mixed traffic makes the numbers useless, and a leaked staging key can then be rotated without touching production.

Rotation

Create the new key, deploy it, then revoke the old one. Revoking takes effect within a minute and has no grace period, so revoking first would break live traffic.

Getting a key

Create one on the keys page: sign in with your Vocaflare account, name the key, copy it. It is displayed once; afterwards only its first and last characters are shown.

Trial keys are self-serve. For production volume, write to [email protected] with what you are building.