API Keys — Authenticate VoiceInfra REST Requests

Every request to the VoiceInfra REST API authenticates with an API key, passed in the X-API-Key header. Treat a key like a password: anyone holding it can act on your workspace’s behalf.

X-API-Key: vk_YOUR_API_KEY

Creating a key

Open the API Keys page

In the portal sidebar, go to API Keys. The page is titled Developer Keys.

Create the key

Click Create Key.

Name it

Give the key a name you will recognise later — for example production-crm or zapier-leads. The name is the only thing you set; keys carry no scopes or expiry of their own.

Copy it immediately

The key is shown once. Copy it before closing the dialog — if you close without copying, VoiceInfra will ask you to confirm, because the key cannot be retrieved again.

Store it securely

Put it in your environment variables or a secrets manager. Never commit it to source control or ship it in client-side code.

If you lose a key, you cannot look it up. Revoke it and create a new one.

Using a key

Pass the key on every request:

curl -X POST "https://<your-region-host>/api/v1/outbound_call" \
  -H "X-API-Key: vk_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "your-agent-uuid",
    "phone_number": "+14155550100",
    "from_number_id": "your-phone-number-uuid",
    "context_variables": { "name": "Sarah" }
  }'

The header name is case-sensitive.

Managing keys

Every workspace can have multiple keys, listed with their Status — Active or Inactive — and the date they were created.

Action	What it does
Deactivate	Turns the key off. It stops working immediately, but stays in the list so you can turn it back on.
Activate	Turns a deactivated key back on. The key value is unchanged.
Revoke	Permanently retires the key. Anything using it stops working immediately, and it cannot be restored without a new key.

Deactivate is reversible; Revoke is not. Use Deactivate when you are rotating credentials and want a window to roll back. Use Revoke when a key is no longer needed or may have been exposed.

Creating one key per integration

A common pattern is one key per system or environment:

production-crm — your CRM placing live customer calls
staging-automation — QA and testing
zapier-leads — a specific no-code workflow

Because keys are independent, you can deactivate or revoke one without disturbing the others. It also makes your delivery logs and usage easier to reason about.

Security practices

Never put a key in client-side code or version control

A key in front-end JavaScript, a mobile app, or a committed repository is effectively public. Load it at runtime on your server, from an environment variable or a secrets manager.

Use a secrets manager for production

Reference the key as process.env.VOICEINFRA_API_KEY (Node.js) or os.environ['VOICEINFRA_API_KEY'] (Python). For production, prefer a manager with access controls and audit logging.

Rotate keys periodically

Create a replacement, update the integration, confirm it works, then revoke the old key. Rotate at least every 90 days, and immediately if you suspect exposure.

Revoke dormant keys

Keys created for finished projects are unnecessary risk. Revoke them.

Use OAuth instead where it fits

If your integration acts on behalf of other people’s accounts, an API key is the wrong shape. See Connected Apps.

Authentication errors

A request with a missing, invalid, or revoked key returns 401. Common causes:

Missing header — the request does not include X-API-Key. The name is case-sensitive.
Inactive key — the key was deactivated. Reactivate it, or create a new one.
Revoked key — the key was revoked and cannot be brought back.
Wrong workspace — the key belongs to a different workspace than the resource you are addressing.
Copy error — a truncated or whitespace-padded value. Copy the key straight from your secrets store rather than retyping it.

Overview

Endpoints

MCP & Apps

API Keys — Authenticate VoiceInfra REST Requests

Creating a key

Using a key

Managing keys

Creating one key per integration

Security practices

Authentication errors

​Creating a key

​Using a key

​Managing keys

​Creating one key per integration

​Security practices

​Authentication errors

Creating a key

Using a key

Managing keys

Creating one key per integration

Security practices

Authentication errors