Authentication

When you create your transcrevo account, an API key is generated automatically: no extra setup step. The key has the tk_... format.

Send the key on every request in the Authorization header:

curl https://api.transcrevo.com/v1/transcripts \
  -H "Authorization: Bearer tk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/audio.mp3" }'

Requests without a key, or with an invalid key, get a 401:

{ "error": { "code": "invalid_api_key", "message": "The Authorization header is missing or the API key is invalid." } }

The key is shown once

We store only the hash of your key, never the value. That means it is shown only when it is created: copy and store it right then. The dashboard keeps listing every key by name, prefix (tk_ab12…) and last-used date, but it cannot show the full value again. Lose it and you create another one.

Multiple keys per account

You can have up to 10 active keys at a time. Separating them by environment or integration (production, CI, import script) pays off: when one has to be revoked, only what used that key stops working.

Every key records its last-used date, which makes it easy to spot the one nobody calls anymore.

Rotation with no downtime

Rotating creates a new key and gives the old one 24 hours of validity instead of killing it immediately. That window is what lets you swap the key in production without an error gap: ship the new one, confirm traffic moved, and the old one expires on its own.

Revoking, unlike rotating, invalidates the key immediately. Use it when you suspect a leak.

Best practices

• Keep the key in an environment variable (TRANSCREVO_API_KEY), never in code or in the repository.
• The key gives full API access to your account: treat it like a password.
• Use the key only on the server. Never expose it in browser code or distributed apps.
• One key per integration. Rotate production keys periodically.