---
title: Realtime client secrets
description: Create a short-lived client secret for a supported realtime model session.
---

<ApiEndpoint method="POST" path="/v1/realtime/client_secrets" auth="api_key" />

Your backend can request a short-lived provider client secret without exposing the long-lived Zorveus API key to browser or mobile code.

<KeyInserter type="api" label="API Key Tester" placeholder="zrv_your_api_key" />

---

## Create a client secret

Your backend requests an ephemeral session token, specifying the permitted model and voice parameters:

<CodeGroup titles={["Python", "TypeScript", "cURL"]}>

```python
import requests

response = requests.post(
    "https://api.zorveus.com/v1/realtime/client_secrets",
    headers={
        "Content-Type": "application/json",
        "Authorization": "Bearer zrv_your_api_key",
    },
    json={"session": {"type": "realtime", "model": "openai/gpt-4o-realtime-preview"}},
)

session_data = response.json()
print("Received client secret:", bool(session_data.get("value") or session_data.get("client_secret")))
```

```typescript
async function createRealtimeSession() {
  const response = await fetch("https://api.zorveus.com/v1/realtime/client_secrets", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: "Bearer zrv_your_api_key",
    },
    body: JSON.stringify({
      session: { type: "realtime", model: "openai/gpt-4o-realtime-preview" },
    }),
  });

  const data = await response.json();
  return data.value ?? data.client_secret;
}
```

```bash
curl https://api.zorveus.com/v1/realtime/client_secrets \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer zrv_your_api_key" \
  -d '{
    "session": {
      "type": "realtime",
      "model": "openai/gpt-4o-realtime-preview"
    }
  }'
```

</CodeGroup>

The returned shape depends on the upstream realtime API version. Accept either a top-level `value` or the documented `client_secret` object, then pass only the short-lived secret to the client.

Use `GET /v1/models` and a controlled test before enabling a realtime model. A route allowlist alone does not prove that a provider deployment, pricing record, and realtime session contract are ready.