## API keys

Each Hume account is provisioned with an **API key** and **Secret key**. These keys are accessible from the Hume Portal.

1. **Sign in**: Visit the [Hume Portal](https://app.hume.ai/) and log in, or create an account.
2. **View your API keys**: Navigate to the [API keys page](https://app.hume.ai/keys) to view your keys.

## Authentication strategies

Hume APIs support two authentication strategies:

1. [**API key strategy**](https://dev.hume.ai/docs/introduction/api-key#api-key-authentication): Use API key authentication for making **server-side requests**. API key authentication allows you to make authenticated requests by supplying a single secret using the `X-Hume-Api-Key` header. Do not expose your API key in client-side code. All Hume APIs support this authentication strategy.

2. [**Token strategy**](https://dev.hume.ai/docs/introduction/api-key#token-authentication): Use Token authentication for making **client-side** requests. With Token authentication you first obtain a temporary **access token** by making a server-side request first, and use the access token when making client-side requests. This allows you to avoid exposing the API key to the client. Access tokens expire after 30 minutes, and you must obtain a new one. Today, only our [Empathic Voice Interface](https://dev.hume.ai/docs/speech-to-speech-evi/overview) (EVI) and [Text-to-Speech](https://dev.hume.ai/docs/text-to-speech/overview) APIs support this authentication strategy.

### API key authentication

To use API key authentication on **REST API** endpoints, include the API key in the `X-Hume-Api-Key` request header.

EVITTS

```
curl https://api.hume.ai/v0/evi/{path} \
  --header 'Accept: application/json; charset=utf-8' \
  --header "X-Hume-Api-Key: <YOUR API KEY>"
```

For **WebSocket** endpoints, include the API key as a query parameter in the URL.

EVI

```
const ws = new WebSocket(`wss://api.hume.ai/v0/evi/chat?api_key=${apiKey}`);
```

### Token authentication

To use Token authentication you must first obtain an Access Token from the `POST /oauth2-cc/token` endpoint.

This is a unique endpoint that uses the [“Basic” authentication scheme](https://en.wikipedia.org/wiki/Basic_access_authentication), with your API key as the username and the Secret key as the password. This means you must concatenate your API key and Secret key, separated by a colon (`:`), base64 encode this value, and then put the result in the `Authorization` header of the request, prefixed with `Basic`.

You must also supply the `grant_type=client_credentials` parameter in the request body.

cURLTypeScriptPython

```
# Assumes `HUME_API_KEY` and `HUME_SECRET_KEY` are defined as environment variables
response=$(curl -s 'https://api.hume.ai/oauth2-cc/token' \
  -u "${HUME_API_KEY}:${HUME_SECRET_KEY}" \
  -d 'grant_type=client_credentials')

# Uses `jq` to extract the access token from the JSON response body
accessToken=$(echo $response | jq -r '.access_token')
```

On the client side, open an authenticated WebSocket by including the access token as a query parameter in the URL.

EVI

```
const ws = new WebSocket(`wss://api.hume.ai/v0/evi/chat?access_token=${accessToken}`);
```

Or, make a REST request by including the access token in the `Authorization` header.

EVI

```
fetch('https://api.hume.ai/v0/evi/chats', {
  headers: {
    Authorization: `Bearer ${accessToken}`,
  },
});
```

## Organization vs personal API keys

If you are part of an Organization, use your **Organization API Key** for all requests across **Text-to-Speech**, **Speech-to-Speech (EVI)**, **Voice Design**, and **Voice Cloning**.

You can regenerate either your Organization or Personal API keys at any time.

### Regenerating API keys

API keys can be regenerated by clicking the **Regenerate keys** button on the API keys page. This permanently invalidates the current keys, requiring you to update any applications using them.