Authentication

Every Shisa service is reached over HTTPS at the shared host https://api.shisa.ai and authenticated with an API key. This guide shows how to get a key, how to keep it safe, and the exact Authorization header each service expects.

Get an API key

Create and manage keys in the Shisa platform. New accounts include $10 in free API credits, which work across all services — LLM, ASR, TTS, and Translation — so you can try everything before adding a payment method.

Keep your key secret

Your API key grants access to your account's credits and quota. Treat it like a password:

• Never commit keys to source control. Read them from an environment variable instead, for example SHISA_API_KEY.
• Never embed keys in client-side code — browser JavaScript, mobile apps, or anything a user can inspect. Call Shisa from your own backend and proxy requests.
• Rotate a key immediately if you suspect it has leaked, and delete unused keys.

# Set the key once in your shell or deployment environment
export SHISA_API_KEY="YOUR_API_KEY"

warning

Do not expose API keys in front-end code or public repositories. A leaked key can be used to spend your credits until you revoke it. Keep keys server-side and load them from the environment.

Authentication header

Every Shisa service uses the same Authorization header:

Authorization: Bearer YOUR_API_KEY

Shisa API keys start with shsk: (for example shsk:abc123…). Pass the entire key, including the shsk: prefix, as the bearer token.

Service	Endpoint	Authorization header
LLM	POST /openai/v1/chat/completions	Authorization: Bearer YOUR_API_KEY
TTS	POST /tts, GET /tts/voices	Authorization: Bearer YOUR_API_KEY
ASR	POST /asr/srt/audio_llm	Authorization: Bearer YOUR_API_KEY
Translation	POST /translate/	Authorization: Bearer YOUR_API_KEY

Example

Shisa LLM is OpenAI-compatible, and every other service uses the identical header. See the LLM quickstart for a full example.

curl -XPOST https://api.shisa.ai/openai/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $SHISA_API_KEY" \
  -d '{"model": "shisa-ai/shisa-v2.1-llama3.3-70b", "messages": [{"role": "user", "content": "こんにちは"}]}'

note

If a request fails with HTTP 401 and an error like Authentication error: Invalid token, the most common cause is a missing or malformed key. Make sure you pass the full key — including the shsk: prefix — as Authorization: Bearer YOUR_API_KEY. See Errors for the full error shapes.

Next steps

• Rate limits — quotas, 429 responses, and backoff.
• Errors — status codes and JSON error shapes.
• SDKs — OpenAI SDKs for LLM and HTTP clients for the rest.