Authentication
One API key. Create a key in the dashboard and you're done — no OAuth dance, no token exchange.
Send your key as a header
Send your API key in the x-api-key HTTP header.
Make an authenticated request
Paste the command below into your terminal to run your first API request. Replace $MUNSIT_API_KEY with your secret API key.
WebSocket authentication
REST requests always use the x-api-key header. WebSocket endpoints accept it too, plus a query-parameter form for browsers, which cannot set headers on a WebSocket connection.
| Endpoint | Header | Query parameter |
|---|---|---|
WS /api/v1/listen — speech to text | x-api-key | api_key (or x-api-key) |
WS /websocket/text-to-speech | x-api-key or Authorization: Bearer | x-api-key — also accepted in the initConnection message |
const ws = new WebSocket("wss://api.munsit.com/api/v1/listen?api_key=YOUR_API_KEY");/api/v1/listen, the connection closes with code 1008 after an Error event.Scope your keys
A key isn't all-or-nothing. Each key can be configured with restrictions and quotas from the dashboard.
| Control | What it does | Use it when |
|---|---|---|
| Endpoint restrictions | Control which API endpoints each key can access — a transcription-only key can't call voice cloning. | Per-service keys, or a key you hand to a contractor. |
| Usage limits | Set custom quotas to manage and monitor your API consumption. | Staging keys, per-customer keys, anything you don't want running away. |
Pick your region
The examples above use the global endpoint (api.munsit.com). If you're in the UAE, use the regional endpoint (ae.api.faseeh.ai) with an API key from the UAE dashboard. See All endpoints for more details.
| Region | Base URL | Dashboard |
|---|---|---|
| Global · default | https://api.munsit.com/api/v1 | app.munsit.com |
| UAE · data residency | https://ae.api.faseeh.ai/api/v1 | ae.app.munsit.com |
ae.app.munsit.com.
Keep it secret
Your key is a bearer credential — anyone holding it can spend your credits. Keep it secure and private.
| Rule | Why | |
|---|---|---|
| ✕ | Never commit keys to version control | Public repo history is scraped continuously. A leaked key is spent within minutes. |
| ✕ | Never share a key publicly | Anyone with the key can call the API as you and consume your quota. |
| ✕ | Never include a key in client-side applications | Anything shipped to the browser or a mobile app is readable. Proxy through your own backend. |
| ✓ | Use environment variables, scope, and rotate | Pair with the endpoint restrictions and usage limits above to bound the blast radius. |
When it fails
Authentication and access failures come back as standard HTTP status codes with a numeric errorCode. The full list lives on Errors.
| Status | Error code | Meaning | Fix |
|---|---|---|---|
| 401 | 40101 | Missing or invalid key | Check the header name is exactly x-api-key, and that the key hasn't expired or been revoked. In curl, wrap the header in double quotes — '…$MUNSIT_API_KEY' sends the literal text instead of your key. |
| 403 | 40301 | Access denied | The key or account can't reach this model or endpoint. Contact support to request access. |
| 429 | 42901 | Concurrency limit exceeded | Wait for current requests to complete or upgrade your plan — see Rate limits. |
Working with an AI assistant? Every page is available as Markdown: add .md to the URL, or send an Accept: text/markdown header. For the whole documentation in one request, point it at llms-full.txt; the page index is llms.txt. Or use Copy Page, top right.