Authentication and usage
Authentication and usage
Before a session starts, the client has to say which software is calling and which end user it is calling for. It can do so in two ways: unauthenticated — your frontend presents the API key and names the account itself — or authenticated — your backend puts both into a token it signs, and the frontend only carries that token. In both cases the same two things are mandatory, an API key and an account; the difference is only how they reach Speechineer.
- API key — mandatory. Identifies your software: it belongs to one workspace and is created Unsigned or Signed. Create a separate one for every use case whose usage you want to follow or cap on its own.
- Account — mandatory. Identifies your end user — a person, a tenant, a device; you decide what it means for your product. A stable id per user, never a shared constant; the first session that names an account key creates it.
- Signing key — authenticated clients only. A key pair whose private half stays in your backend and signs a short-lived token per logged-in user, carrying the API key and the account.
How each of them is handled, unauthenticated or authenticated:
| Unauthenticated | Authenticated | ||
|---|---|---|---|
| Fit | public pages and development | anything behind a login | |
| Who can use Speechineer in your form | anyone who can open the form | only users your backend issues a token to | |
| API key | Mode | Unsigned | Signed |
| Location | your frontend — the client passes it in its apiKey option | your backend — the token carries it in its api_key claim | |
| Account | Location | your frontend — the client names it in its account option | your backend — the token carries it in its account_key claim |
| Signing key | not needed | needed — its private half signs every token | |
Danger
In this section
- API keys
You create keys in the right mode, wire an unauthenticated client, and cap or expire each key.
- Signing keys
You generate a key pair, mint tokens in your backend, hand the client a token function, and rotate.
- Accounts
You choose what an account is, read accounts in the workspace, and manage them from your backend.
- Usage tracking and limits
You read how usage is attributed, where limits exist, and which code fires when one is reached.
Next: with a key and an account in place, wire the SDK — Integrate the SDK.