> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rime.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> How to authenticate with the Rime TTS API using a bearer token.

Every request to the Rime API requires a **bearer token**. Send it in the `Authorization` header. WebSocket clients that cannot set headers may instead pass `?rime_apikey=YOUR_API_KEY` on the connection URL, but this puts the key in URLs and proxy logs, so prefer a server-side bridge that sets the header.

## Get an API key

<Warning>
  An API key can synthesize speech against your account. Keep it on the server and treat it like a password.
</Warning>

1. Sign in to the [Rime dashboard](https://app.rime.ai).
2. In the Rime dashboard, open [**API Tokens**](https://app.rime.ai/tokens).
3. Create a token and copy its value.

## Use the token

This request authenticates with a bearer token and returns MP3 audio:

```bash theme={null}
curl --request POST \
  --url https://users.rime.ai/v1/rime-tts \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --header 'Accept: audio/mpeg' \
  --data '{"speaker":"astra","text":"hello","modelId":"coda","lang":"en"}'
```

Use the same header for the HTTP, WebSocket, metadata, and utility endpoints.

## CLI authentication

The `rime` CLI manages the key locally. Run [`rime login`](/cli-reference/rime-auth) once, and the CLI stores the key at `~/.rime/rime.toml`. You can also set it with the `RIME_CLI_API_KEY` environment variable.

## On-prem authentication

The on-prem API service accepts the same `Authorization: Bearer …` header. You can also configure `RIME_API_KEY` for the deployment so callers don't need to send the header. See [the on-prem quickstart](/docs/on-prem/quickstart) for details.

## Common auth errors

If your request fails authentication, the API returns `401 Unauthorized` with a short plain-text body explaining why:

| Status | Body              | Cause                                                                    |
| :----- | :---------------- | :----------------------------------------------------------------------- |
| `401`  | `missing headers` | No `Authorization` header was sent.                                      |
| `401`  | `invalid api key` | The token is not recognized, or it was sent without the `Bearer` scheme. |

Always send the header as `Authorization: Bearer <token>` (capital `B`). The token alone, without `Bearer`, is rejected.

## Related

* [Quickstart: TTS in five minutes](/docs/quickstart-five-minute)
* [API reference index](/docs/api-reference)
* [CLI authentication commands](/cli-reference/rime-auth)