Authentication

All API requests to Voxxi require authentication. Authentication is scoped at the organization level, ensuring that your API access is properly isolated and secured within your organization's context.

Overview

Voxxi uses Bearer Token Authentication to secure API endpoints. Each request must include a valid API key in the authorization header to access protected resources.

Obtaining Your API Key

To get your API key:

1. Navigate to the Voxxi application
2. In the side navigation, go to Settings → API Keys
3. Click Create API Key or use an existing key
4. Copy the generated API key securely

Authentication Header

Include your API key in the Authorization header of every request using the Bearer token format:

Authorization: Bearer YOUR_API_KEY_HERE

Example Request

curl -X GET "https://api.voxxi.ai/v1/endpoint" \
  -H "Authorization: Bearer vx_1234567890abcdef" \
  -H "Content-Type: application/json"

// JavaScript/Node.js example
const response = await fetch('https://api.voxxi.ai/v1/endpoint', {
  headers: {
    'Authorization': 'Bearer vx_1234567890abcdef',
    'Content-Type': 'application/json'
  }
});

# Python example
import requests

headers = {
    'Authorization': 'Bearer vx_1234567890abcdef',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.voxxi.ai/v1/endpoint', headers=headers)

Authentication Errors

When authentication fails, the API will return one of the following HTTP status codes:

Error Response Format

{
  "error": {
    "code": "authentication_failed",
    "message": "Invalid or missing API key",
    "type": "authentication_error"
  }
}

Organization Scope

Your API key provides access to resources within your organization only. This ensures:

• Data isolation: You can only access data belonging to your organization
• Resource separation: API quotas and limits are applied per organization
• Audit trails: All API activity is logged and attributed to your organization

Rate Limits

API keys are subject to rate limiting based on your subscription plan. Monitor the following response headers:

• X-RateLimit-Limit: Maximum requests allowed per time window
• X-RateLimit-Remaining: Requests remaining in current window
• X-RateLimit-Reset: Time when the rate limit window resets