Authentication

Production service credentials belong on your backend. Your browser, mobile web app or Telegram Mini App should receive only the scoped data needed for the current interaction.

Production access

Access is enabled by arrangement. We provide the service base URLs, authentication scheme, key scope and enabled capabilities during onboarding. A sales request does not automatically issue an API key.

Keep keys on the server

Store secrets in your deployment's runtime environment or secret store. Use separate credentials for development and production. Never place production credentials in browser bundles, public configuration, analytics events or documentation.

# Illustrative server configuration; values are issued during onboarding.
AMORA_API_BASE_URL=YOUR_ASSIGNED_BASE_URL
AMORA_API_KEY=YOUR_SERVER_SIDE_KEY

Environment names above describe an integration convention. They are not evidence of a provisioned endpoint.

Voice session credentials

For a production voice integration, the backend creates the call. The client receives signed, call-specific connection data and uses the audio client to connect. The account-level key stays on the server.

Signed links authorize a specific interaction. Treat them as credentials: do not log their query strings or put them in public links.

Authentication differences

The final service contract determines the required header. Some generation interfaces use a Bearer token; call-creation services may use an API-key header. Do not assume a single header works across every service until your integration contract confirms it.

Rotation and access changes

Arrange key rotation with our team, update the server configuration, verify the replacement and revoke the old key. Scope character access, usage and administrative operations to the needs of the integration.