SEC 06 / AUTH & CREDENTIALS
Auth & credential design
Every SDK in this ecosystem eventually runs into the same design question: where does the secret live? The answer is consistent across REST clients, browser agents, and mobile apps — permanent credentials stay on a server you control, and anything that reaches a client device is short-lived, scoped, and disposable.
Permanent API keys
Server-side REST clients authenticate with the ElevenLabs API key. Keys can be restricted by:
- product or endpoint scope;
- credit quota;
- IP allowlist.
The key belongs only in a trusted server, secret manager, CI/CD secret store, or protected local environment, per the authentication docs.
Never put it in:
- browser JavaScript bundles;
- mobile application source;
- desktop application binaries;
- public repositories;
- client-visible environment variables;
- query strings or analytics events.
Ephemeral credentials for clients
For browser or mobile access, use an ephemeral credential instead of the permanent key:
- single-use token for supported real-time services;
- signed URL;
- conversation token for a private agent.
The backend issuing this credential should:
- authenticate the user;
- authorize access to the specific agent or feature;
- rate-limit issuance;
- return only the shortest-lived credential required.
Speech Engine JWT
Speech Engine authenticates connections through a short-lived JWT derived from the configured secret/API key relationship. The SDK verifies this by default — see the Speech Engine reference for the verification flow. Disabling verification should be limited to tightly isolated environments protected by network controls.
Client tools are untrusted input
Agent client tools allow the model or agent workflow to ask the client application to execute a function. Treat every tool invocation as untrusted input:
- validate arguments;
- enforce user authorization;
- restrict possible destinations and resource identifiers;
- require confirmation for destructive operations;
- prevent arbitrary URL fetches or command execution;
- return sanitized results.
The existence of an agent instruction does not confer application authorization. A tool call is a request, not a credential — it still has to clear the same authorization checks any other user-triggered action would.