API keys

Keys authenticate server-side requests to api.getciabatta.com. Never put a key in browser or mobile app code: create a voice session on your server and hand the browser only the session's ws_url and short-lived token (how).

Live vs. test keys

sk_live_ keys are billed from your balance. sk_test_ keys are free and limited (voice calls end after 2 minutes, short daily quotas). Use them for CI and integration tests.

Protect against leaks

Give each environment its own key, set a monthly spending cap, and revoke a key instantly if it is exposed. Revocation takes effect within 30 seconds.