Every endpoint except GET /health needs a credential. For an integration that credential is a personal access token, sent as a bearer token.

​
Personal access tokens

Create one in the dashboard under Organization → API Tokens. The plaintext value is shown once, at creation, and never again — store it before you close the dialog. A token is a signed string with no prefix and no expiry. Do not parse it, and do not assume a shape.
A personal access token carries its creator’s live role. Change that person’s role and every token they hold changes with it; remove them from the workspace and their tokens stop working on the next request. There is no per-token scope and no read-only token.
Revocation is deleting the token’s row in the dashboard. The signature itself never expires, so the row is the check — which is also why revocation is immediate rather than eventual.
One token reaches every region — it names your workspace, not a place. See regions. Signing in with Google sets talqing_session, an httponly cookie on the registrable domain, so it reaches every region’s API host. It is what the dashboard authenticates with, it lasts 30 days, and it is stateless — there is no way to revoke one before it expires. Pass credentials: "include" in the TypeScript SDK to use it instead of a token. Nothing else should.
Never put a personal access token in a browser. A token has your full role and no scope, so shipping one to a page hands every visitor your workspace. To let a browser join a call, mint a short-lived LiveKit room token on your server with POST /v1/calls/token and send only that to the page — see web calls.

​
401 versus 403

401 means the credential is missing, malformed, revoked, or no longer a member of the workspace. The messages you will see are not authenticated (no credential at all), invalid token, invalid session, and the control plane’s own verdict passed through, such as token revoked. A 401 is final — retrying the same request with the same credential gets the same answer. 403 means the credential is good and the role is not high enough. Two messages, and they tell you which: Membership and role are re-read on every request and never cached, so a demotion or a removal takes effect on the very next call.
A 503 with the control plane is unreachable, so this request cannot be authorized is not an auth failure. The credential may be perfectly good and we could not check it. Retry.

​
Which role an operation needs

Three roles: ADMIN, EDITOR, VIEWER. Roles are per workspace and are managed in the dashboard — see workspaces and roles. Secrets and provider keys are ADMIN-only in both directions of writing, but their list endpoints are readable by everyone — reads return only a name and a masked tail, never a value.
POST /v1/calls/token needs EDITOR. The request can carry a whole agent definition, an override or a team, which means running an arbitrary prompt on an arbitrary model paid for with the workspace’s own provider keys. A VIEWER cannot start a web call over the API.

​
Provider keys are not Talqing tokens

Talqing is strictly bring-your-own-key. The token on this page authenticates you to Talqing; the OpenAI, Deepgram or ElevenLabs key that actually runs your agent is a provider key, stored per workspace and never sent in a request header. See provider keys.