Guides

Authentication

CALL-E uses project API keys for server-to-server requests.

API keys

Create and manage API keys in the CALL-E dashboard. Production API keys use the iams_live_ prefix. Pass the complete dashboard value directly to the SDK; no client-side token exchange is required.

Store the key in your backend secret manager or runtime environment:

Code
export CALLE_API_KEY="iams_live_example"

Do not commit API keys, print them in logs, send them to browser code, or store them in mobile apps. The CALL-E SDKs are server SDKs for trusted backend services and workers.

Authorization header

Check API access with a read-only request:

Code
curl -i "https://api.heycall-e.com/v1/goals?limit=1" \
  -H "Authorization: Bearer $CALLE_API_KEY"

-i shows the HTTP status and headers. 200 OK means the request succeeded, even if data is empty. See Auth errors for 401 and 403.

SDK clients set this header for you.

TypeScript:


Code
import { CalleClient } from "@call-e/calle";

const client = new CalleClient({
  apiKey: process.env.CALLE_API_KEY!,
  baseUrl: "https://api.heycall-e.com",
});

Python:


Code
import os
from calle import CalleClient

client = CalleClient(
    api_key=os.environ["CALLE_API_KEY"],
    base_url="https://api.heycall-e.com",
)

Environments

Use an explicit base URL in each environment so staging jobs do not accidentally send live calls.

Code
export CALLE_BASE_URL="https://api.heycall-e.com"

The example SDK servers and call scripts read CALLE_BASE_URL when you provide it. Keep test and production API keys separate, and do not reuse idempotency keys across environments.

Server-only usage

Only call the Developer API from trusted server code:

backend API handlers
job workers
workflow runners
internal automation services

Do not call the Developer API directly from a browser, public frontend, or untrusted client. If a frontend user needs to start a call, send the request to your backend first, validate the user, and let your backend call CALL-E with its project API key.

See Webhooks when your backend needs terminal call task notifications.

Auth errors

401 unauthorized means the API key is missing, malformed, expired, or invalid. Check the Authorization: Bearer header and the environment variable loaded by the running process.

403 forbidden means the key is valid but does not have access to the requested project, capability, region, or operation.

When rotating keys, deploy the new key to all workers before disabling the old key so in-flight retries do not fail unexpectedly.

Quickstart Calls