Overview
Authentication
How Voxmith authenticates ingestion, dashboard, and API requests
Voxmith uses different authentication models for ingestion and dashboard/API access.
SDK ingestion
SDK ingestion endpoints under /api/v1/* use your organization ID in the
x-org-id header. SDK configuration and environment variables may format it as
org_id, orgId, or VOXMITH_ORG_ID; all refer to the same organization ID.
The org ID is a public routing identifier. It does not grant dashboard read access by itself.
Dashboard and API access
Dashboard API endpoints use one of these:
| Method | Headers | Use case |
|---|---|---|
| JWT | Authorization: Bearer <jwt> and x-org-id |
Browser/dashboard access after login |
| API key | x-api-key and optional x-org-id |
Programmatic dashboard/API access |
API keys use the voxmith_<64-hex> format and are issued from Settings -> API Keys.
Common mistakes
- Sending
x-org-idwithout a JWT or API key to dashboard endpoints. - Using the wrong org ID when a user belongs to multiple organizations.
- Forgetting the
X-Voxmith-Org-IDheader on OpenTelemetry exporters. - Treating the org ID as a secret. Rotate API keys if they leak; org IDs are routing identifiers.
Related pages
Next steps
- Packages and versions: choose the package that matches your application.
- Capture a session: create a conversation boundary through the API.
- Capture an event: send activity into an existing session.
Was this page helpful?