Realtime client secrets

Your backend can request a short-lived provider client secret without exposing the long-lived Zorveus API key to browser or mobile code.

Create a client secret

Your backend requests an ephemeral session token, specifying the permitted model and voice parameters:

import requests

response = requests.post(
    "https://api.zorveus.com/v1/realtime/client_secrets",
    headers={
        "Content-Type": "application/json",
        "Authorization": "Bearer zrv_your_api_key",
    },
    json={"session": {"type": "realtime", "model": "openai/gpt-4o-realtime-preview"}},
)

session_data = response.json()
print("Received client secret:", bool(session_data.get("value") or session_data.get("client_secret")))

The returned shape depends on the upstream realtime API version. Accept either a top-level value or the documented client_secret object, then pass only the short-lived secret to the client.

Use GET /v1/models and a controlled test before enabling a realtime model. A route allowlist alone does not prove that a provider deployment, pricing record, and realtime session contract are ready.