Skip to main content
Send an API key, or a client token minted from it, in the Authorization header:
If you still need a key, start with Get an API key.

​
Client tokens

Never ship your API key to a browser. Instead, call POST /v1/client_tokens from your server with the API key, and hand the short-lived, capped token it returns to the browser. The browser then sends the token exactly where it would send the key. The token carries only the scopes you request in scopes, and the key that mints it must hold each of them. WebSocket clients that cannot set an Authorization header, such as browsers, send the credential as the subprotocol pair Sec-WebSocket-Protocol: access_token, <credential> instead.

​
Scopes required by each endpoint

interhumanai.upload covers POST /v2/upload/analyze with either model=inter-2 or model=inter-2-audio, and interhumanai.stream covers WS /v2/stream/analyze on either model. No separate scope is needed for Inter-2 Audio. An API key must hold the scope itself. A client token must be minted with it.

​
When authentication fails

  • A missing credential (ih2002), an invalid API key (ih2001), or a client token that is expired (ih2010), invalid or minted by a key that is no longer active (ih2011), or revoked (ih2014) is rejected with 401.
  • A valid credential without the endpoint’s scope is rejected with 403 (ih2003), and the message names the scope.
  • Minting a client token with a scope the key does not hold is rejected with 403 (ih2009).
See Error handling for every code.