Get started

Authentication

Authenticate every request with an API key. Create keys in the dashboard under API Keys (or via the Workspace API). Keys are prefixed vx_live_…, are workspace-scoped, and carry a set of permission scopes.

Send your key

Use either the Authorization: Bearer header or the x-api-key header — both accept the same vx_live_… key:

bash

# Bearer
curl https://api.bolchoai.in/v1/agents -H "Authorization: Bearer $BOLCHO_API_KEY"

# or x-api-key
curl https://api.bolchoai.in/v1/agents -H "x-api-key: $BOLCHO_API_KEY"

Scopes

Keys hold one or more scopes; an endpoint requires the scope noted on it. Available scopes: agents:read, agents:write, knowledge:read, knowledge:write, tools:read, tools:write, calls:read, calls:write, chat:read, chat:write, analytics:read, billing:read, billing:write, workspace:admin.

Publishable keys

Public chat widgets use a separate publishable key (pk_live_…) sent in the x-voxa-public-key header. Publishable keys are safe to ship in browser HTML — they're locked to an assistant, an allow-list of domains, and a rate limit. See the Public Chatbot API.

Dashboard tokens

Browser sessions use a short-lived JWT plus an x-workspace-id header instead of an API key. For server-to-server integrations, always use an API key (vx_live_…).

Keep API keys secret — they grant full programmatic access to your workspace. Rotate a key by creating a new one and deleting the old. (Publishable pk_live_ keys are not secret.)