> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mayaresearch.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> One header, one key.

Every request carries a bearer token:

```
Authorization: Bearer maya_hk_live_...
```

Get a key from the [studio](https://www.mayaresearch.ai/studio/developers).

## Keep it out of the browser

A key is a credential for **your** account. Anything that ships to a browser
ships the key with it — put it in an environment variable and call the API from
your own server.

```bash theme={null}
export MAYA_API_KEY="maya_hk_live_..."
```

## WebSocket auth

Prefer the header, so the key never lands in a URL or an access log:

```
Authorization: Bearer <MAYA_API_KEY>
```

Browsers cannot set headers on a WebSocket, so a query parameter is accepted as
a fallback:

```
wss://tts.mayaresearch.ai/v1/tts/stream?key=<MAYA_API_KEY>
```

<Warning>
  Query strings are logged by proxies and stored in browser history. Use this
  only where the header is genuinely impossible, and never for a key with real
  credit behind it.
</Warning>

## When a key that looks right is rejected

Almost always a transcription error. In most fonts capital **I** and lowercase
**l** are drawn identically, and a dropped character is invisible:

```
maya_hk_live_...RvInsDxi...     ✗  55 characters
maya_hk_live_...RvlnsfDxi...    ✓  56 characters
```

<Tip>
  **Paste keys. Never retype them**, and never read one off a screenshot.
</Tip>