Skip to main content
Sign in through Labs Auth to initialize your workspace before using the API. Your credentials identify a user; that user’s membership and role determine access to workspace resources.

​
Labs API keys

Create and revoke user API keys through the Labs platform. Copy a new key when shown and keep it in your application’s secret store. Key management is not available inside the Agent Builder console in this release. Set LABS_AUTH_API_KEY to your key and VOAI_ORGANIZATION_ID to the positive integer ID of a workspace you belong to. Ask your workspace administrator for the ID if needed.
Both headers are required for API-key requests. The workspace ID is checked against the key owner’s membership; changing your workspace in the console does not change an API request’s workspace. Keys inherit their owner’s permissions and do not grant administrator access by themselves.

​
OAuth user access tokens

Endpoints that support user access tokens accept:
Obtain a user access token through an authorized Labs OAuth client. Contact your Labs administrator if your application does not have one. User tokens expire within 15 minutes; your OAuth client must obtain a fresh token when needed. Keep tokens on your server and out of browser storage and logs. Bearer requests use the user’s selected workspace. Outbound call and campaign endpoints require a user access token with the Labs super_user role. Starting calls or changing campaigns also requires Editor or higher workspace access. Configuring telephony requires Admin or Owner access plus super_user. API keys cannot call these bearer-only endpoints. The endpoint reference shows which credential types each operation accepts. Do not send both a bearer token and an API key in one request, and do not use an API key as a bearer token. The former X-API-Key header is not supported.

​
Rotate or revoke a key

Create a replacement through Labs, update your application’s secret, and verify a read request before revoking the old key. Revocation takes effect on the next API request. Removing a user’s workspace membership also removes that user’s API-key access to that workspace. The interactive API reference sends requests to the configured API host. Write requests change workspace data, and outbound call requests can place real calls. See roles and permissions and errors when a valid credential cannot perform an operation.