Skip to main content
API keys authenticate requests to the REST API and the MCP server.

​
Creating a key

  1. Open the OpenWhispr desktop app
  2. Click Integrations in the left sidebar
  3. On the API card, click Manage keys
  4. Click Create API Key, give it a name, and tick the permissions you need
  5. Choose an expiry — Never expires, 30, 60 or 90 days, or 1 year
  6. Copy the key — it starts with owk_live_ and is only shown once
Key management is offered on paid plans.

​
What the app can grant

The dialog offers three permissions: Every key also gets usage:read, which isn’t shown as a checkbox and isn’t listed on the key afterwards.
transcriptions:delete is the one scope the app can’t grant — there’s no checkbox for it, so a key made in the desktop app can’t delete transcriptions. To get one, create the key through the API and name the scope explicitly.
Store your key securely. If you lose it, revoke it and create a new one.

​
Creating keys via the API

AI assistants can create their own keys programmatically using the agent setup flow. You can also manage keys via the API:
  • POST /api/v1/keys/create — create a new key
  • GET /api/v1/keys/list — list active keys
  • POST /api/v1/keys/{id}/revoke — revoke a key
These endpoints accept both desktop session auth and agent session tokens (owt_ prefix).
Known discrepancy: the published OpenAPI contract for GET /api/v1/keys/list returns { "data": [...] } — an array directly under data. The current desktop app’s key-management client code expects { "data": { "keys": [...] } } instead. Until this is reconciled, don’t assume either shape — inspect the actual response before building an integration against it.

​
Scopes

Each key has specific permissions. Choose only what you need. Team spaces use a separate kind of key with its own scopes — see Workspace API keys.

​
Limits

  • Max 5 API keys per user (workspace keys are counted separately — 20 per workspace)
  • Expiry is chosen at creation: never, 30, 60 or 90 days, or 1 year
  • Keys can be revoked at any time from the desktop app

​
Key format

Keys are 32 bytes of cryptographic randomness, prefixed with owk_live_ for identification. Only the SHA-256 hash is stored server-side — the raw key cannot be recovered after creation.

​
Best practices

  • Use separate keys for different integrations so you can revoke one without affecting others
  • Set expiration dates for keys used in temporary automations
  • Use the minimum scopes needed — a read-only dashboard doesn’t need notes:write