Skip to main content

Authentication

Every Shisa service is reached over HTTPS or WSS at the shared host api.shisa.ai and authenticated with an API key. This guide shows how to get a key, how to keep it safe, and the exact Authorization header each service expects.

Get an API key​

Create and manage keys in the Shisa platform. New accounts include $10 in free API credits, which work across all services — LLM, ASR, TTS, and Translation — so you can try everything before adding a payment method.

Keep your key secret​

Your API key grants access to your account's credits and quota. Treat it like a password:

  • Never commit keys to source control. Read them from an environment variable instead, for example SHISA_API_KEY.
  • Never embed keys in client-side code — browser JavaScript, mobile apps, or anything a user can inspect. Call Shisa from your own backend and proxy requests.
  • Rotate a key immediately if you suspect it has leaked, and delete unused keys.
# Set the key once in your shell or deployment environment
export SHISA_API_KEY="YOUR_API_KEY"
warning

Do not expose API keys in front-end code or public repositories. A leaked key can be used to spend your credits until you revoke it. Keep keys server-side and load them from the environment.

Authentication header​

Every Shisa service uses the same Authorization header:

Authorization: Bearer YOUR_API_KEY

Shisa API keys start with shsk: (for example shsk:abc123…). Pass the entire key, including the shsk: prefix, as the bearer token.

ServiceEndpointAuthorization header
LLMPOST /openai/v1/chat/completionsAuthorization: Bearer YOUR_API_KEY
TTSPOST /tts, GET /tts/voices, WSS /ws/tts/realtimeAuthorization: Bearer YOUR_API_KEY
ASRPOST /asr/srt/audio_llm, WSS /ws/asr/realtimeAuthorization: Bearer YOUR_API_KEY
TranslationPOST /translate/Authorization: Bearer YOUR_API_KEY

Example​

Shisa LLM is OpenAI-compatible, and every other service uses the identical header. See the LLM quickstart for a full example.

curl -XPOST https://api.shisa.ai/openai/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $SHISA_API_KEY" \
  -d '{"model": "shisa-ai/shisa-v2.1-llama3.3-70b", "messages": [{"role": "user", "content": "こんにちは"}]}'
note

If a request fails with HTTP 401 and an error like Authentication error: Invalid token, the most common cause is a missing or malformed key. Make sure you pass the full key — including the shsk: prefix — as Authorization: Bearer YOUR_API_KEY. See Errors for the full error shapes.

Next steps​

  • Rate limits — quotas, 429 responses, and backoff.
  • Errors — status codes and JSON error shapes.
  • SDKs — OpenAI SDKs for LLM and HTTP clients for the rest.