Authentication

All Kova TTS requests authenticate with an API key in the x-api-key HTTP header. Keys start with kova_sk_.

x-api-key: kova_sk_...

Kova uses x-api-key, not Authorization: Bearer. The header name is case-insensitive — x-api-key and X-API-KEY both work. Sending Authorization: Bearer <key> returns 401; the header is ignored entirely.

Getting a key

Open platform.kova.ai and sign in (or sign up).

Open the API keys page

Navigate to Dashboard → API keys.

Create a key

Click Create key, name it (e.g. “production-backend”), and copy the key. You can only view the full key once — store it in your secret manager immediately.

Using the key

from kova_tts import KovaTTSClient
client = KovaTTSClient(api_key="kova_sk_...")

import { KovaTTSClient } from "@kova-ai/tts";
const client = new KovaTTSClient({ apiKey: "kova_sk_..." });

curl https://api.kova.ai/v1/tts \
  -H "x-api-key: kova_sk_..." \
  -H "content-type: application/json" \
  -d '{"text":"...","voice":"cal"}'

Security

Never commit keys to source control. Use environment variables or a secret manager.
Rotate keys if you suspect compromise. Old keys keep working until you delete them on the dashboard.
Use one key per environment / service. Easier to identify what’s spending and to revoke selectively.

On WebSocket connections

The key goes on the handshake, not in a frame after connecting:

GET /v1/tts/ws HTTP/1.1
Upgrade: websocket
Host: api.kova.ai
x-api-key: kova_sk_...

A missing, empty, whitespace, or malformed x-api-key is rejected at the handshake with HTTP 403, before the connection is accepted — no frames are exchanged and no audio is generated. A well-formed kova_sk_ key that is revoked or unknown is accepted at the handshake and rejected on first use with {"error": "INVALID_API_KEY"} followed by close code 1008. Browsers can’t set custom handshake headers, so browser clients should use Streaming HTTP or proxy through a backend.

Errors

Code	Body	Cause
`401`	`{"error": "Invalid or missing API key"}`	Header missing, or value doesn’t start with `kova_sk_`. Also returned for `Authorization: Bearer`.
`401`	`{"error": "INVALID_API_KEY"}`	Header is well-formed but the key doesn’t exist or was revoked.
`402`	`{"error": "INSUFFICIENT_CREDITS"}`	The account has no remaining credit. Top up at platform.kova.ai/dashboard/billing.

All three carry an x-request-id response header — log it. See Errors for the complete reference.

Get started

HTTP API

WebSocket API

Voices

Integrations

SDKs

Reference

Authentication

Getting a key

Using the key

Security

On WebSocket connections

Errors

​Getting a key

​Using the key

​Security

​On WebSocket connections

​Errors

Getting a key

Using the key

Security

On WebSocket connections

Errors