Skip to main content
Kupe accepts a single Authorization header on every /v1 route.
Project API keys start with sk-kupe-. Dashboard sessions can send a Supabase user JWT instead.

Environment

SDKs always join paths as {base}/v1/.... Do not put /v1 in KUPE_BASE_URL.

Who am I?

API keys are scoped to one org and one project. JWT callers are a user, not a project, so those IDs are null.
"api_key" | "jwt"
How this request was authenticated.
string | null
Set for API keys. Null for JWT.
string | null
Set for API keys. Null for JWT.
string | null
Set for JWT callers.
string | null
Set for API-key callers.
Use these IDs on nested routes such as GET /v1/orgs/{org_id}/projects/{project_id}/agents.

JWT-only routes

Voice clone / patch / delete require a signed-in user (auth: jwt). Calling them with an API key returns 403. Listing catalog voices, preview, and speak still work with a key where noted in the Voices guide.

Keys

Create and revoke keys from a project:
  • POST /v1/projects/{project_id}/api-keys
  • GET /v1/projects/{project_id}/api-keys
  • DELETE /v1/projects/{project_id}/api-keys/{key_id}
Treat keys like passwords. The playground stores the Bearer token in the browser only for that session — never commit sk-kupe-... to git.