Developer platform

Authentication

Evom Labs uses scoped credentials, one group of tasks per credential. Use the right type of key for the endpoint you are calling.

On this page

Credentials
REST
WebSocket
Verify a key
Usage
Handling credentials

Credentials

Credential	Scope	Purpose
`stt_sk_live_*`	stt.transcribe	Batch transcription and real-time STT. Multiple active keys can be issued in Studio.
`vc_ak_live_*`	voices.write	Enrolls a voice. Account scoped, and not bound to any voice.
`vc_sk_live_*`	tts.generate, tts.stream, usage.read	Generation, streaming and usage. Bound to exactly one voice.
`Stream token`	Short-lived	Opens the Loly 3.5 streaming WebSocket. Issued by the stream-token endpoint and valid for 60 seconds.

Not interchangeable

An STT key cannot call a TTS endpoint, and a voice key cannot enroll a voice. Using the wrong type returns an authentication error.

REST

REST requests carry the API key in the Bearer Authorization header.

HTTP

Authorization: Bearer vc_sk_live_YOUR_KEY

Loli 2.0 uses its own key on the same header.

HTTP

Authorization: Bearer stt_sk_live_YOUR_KEY

WebSocket

Loli 2.0

Loli 2.0 passes the STT key itself in the token query parameter, because a browser WebSocket cannot set a custom header.

Loly 3.5

Loly 3.5 passes a short-lived stream token instead of the API key, and the socket URL comes from the ws_url field of the stream-token response.

Security

A query parameter can end up in proxy and browser logs. Open these connections over TLS only, keep the full URL out of your logs, and open the STT socket from your own server rather than from client-side code.

Verify a key

GET/api/public/v1/auth/check

Checks the status of an STT API key.

curl

curl https://studio.evomlabs.com/api/public/v1/auth/check \
  -H "Authorization: Bearer stt_sk_live_YOUR_KEY"

JSON

{"status":"ok","api_key":"valid"}

Needs verification

This path belongs to the STT gateway. Whether it is reachable on the public origin depends on the edge configuration of each deployment.

Usage

GET/api/v1/usage

Reads the allowance of the account behind the voice key.

curl

curl https://studio.evomlabs.com/api/v1/usage \
  -H "Authorization: Bearer vc_sk_live_YOUR_KEY"

JSON

{
  "ok": true,
  "data": {
    "environment": "live",
    "limit": 500,
    "used": 1234,
    "remaining": 498766,
    "reset_date": "2026-09-01T00:00:00.000Z"
  }
}

How the allowance is deducted

Batch generation deducts by the length of the submitted text. Streaming deducts when the stream token is issued, by the declared text_length. Refund behaviour follows the current contract.

Handling credentials

Credential security

Do not put an API key in public source code, a client bundle, a system log or an ordinary URL. Send a WebSocket token over a TLS connection only.

Use keys server-side only. Putting one in browser JavaScript publishes it.
Keep them in a secret manager or an environment variable, never in Git.
Revoke a key in Studio as soon as it may have leaked.
Issue a separate key per environment so they can be revoked independently.