Authentication
Authenticate API requests safely with a Bearer key.
Send your API key in the Authorization header on every authenticated request.
Authorization: Bearer <API_KEY>Store the key in a server-side environment variable or secret manager. Do not place it in browser code, mobile binaries, or a public repository. For browser products, call Sawtak Arabi through your own server so the key stays private.
Scopes
Keys can be limited to functional scopes. Use the smallest scope set required by the integration:
| Scope | Allows |
|---|---|
tts | Text-to-speech synthesis |
voices | Voice catalog and voice management |
usage | Account introspection and usage reporting |
An unrestricted key can access the standard API operations. A scoped key that lacks a required permission receives 403 with the insufficient_scope error code.
Verify a key
Call GET /v1/me with a key that has the usage scope. A successful response confirms the credential and returns account information. If authentication fails, replace the key instead of repeatedly retrying: repeated failed attempts can be throttled.
curl --fail --show-error https://api.sawtakarabi.ai/v1/me \
-H "Authorization: Bearer $SAWTAK_API_KEY"See Errors for the response envelope and Request limits for throttle handling.