Authentication

Authenticate MeetWave API requests with a secret key in the Authorization header, and keep the key on your server.

Get a key

Create a key in the developer console. The full key is shown once, when you create it: put it into your secret store then. After that the console shows only its last four characters; a lost key is regenerated, and your servers get the new one.

A new account gets free credits when it creates its first key: one hour of audio with speaker names, more without them. They are spent before paid credits and last 60 days.

Send it with every request

Every request to https://api.meetwave.io/v1 carries the key in the Authorization header as a bearer token. Keys start with mwk_. The samples on these pages read it from the MEETWAVE_API_KEY environment variable.

curl https://api.meetwave.io/v1/transcriptions/$TRANSCRIPTION_ID \
  -H "Authorization: Bearer $MEETWAVE_API_KEY"

Every key of an account sees every transcription of that account, whichever key created it. Requests per minute and transcriptions in progress are counted per key, so a key per service keeps one busy service from slowing another.

When the key is refused

A missing, malformed or unknown key gets 401 INVALID_API_KEY; a key deactivated in the console gets 403 API_KEY_INACTIVE. When your credits are used up, a new transcription gets 402 INSUFFICIENT_CREDITS: top up in the console and send it again. Every error has the same body:

{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid API key."
  },
  "meta": {
    "requestId": "req_8b4c2e1f-6a9d-4f3b-9c7e-2d5a1b0f4e6c",
    "timestamp": 1792584000000
  }
}

message is for people and may change; branch on code. Every code is listed in Errors and limits.

Response headers

Header	Type	Meaning
`X-Request-Id`	`req_…`	On every answer, errors included. Quote it when you write to support.
`X-RateLimit-Limit`	`integer`	Requests one key may make per minute (120). Sent once the key is accepted.
`X-RateLimit-Remaining`	`integer`	Requests left to this key in the current minute.
`Retry-After`	`seconds`	On a 429: how long to wait before the next try.

Keep the key on your server

Anyone holding the key can spend your credits and read your transcriptions. Call the API from your backend, keep the key in an environment variable or a secret store, and never put it into a web page, a mobile app or a repository. Deactivate a key that leaked in the console at once: its next request gets 403.