Skip to main content

​
Authentication

Use an API key in the x-api-key header or as an Authorization: Bearer credential. Remote MCP clients can also sign in through OAuth. OAuth access tokens are valid for the MCP resource only; use an API key for REST calls.

​
Create a scoped key

Open Integrations, create a key, and select its permissions and optional expiration. The full key is shown once. Keep it in your secret store. You can rename it, change its permissions or expiration, or revoke it later.

​
Permissions

Each action declares its required permissions in the action catalog. An action can require several permissions. Reading does not grant permission to create, modify, or delete. Existing keys without explicit permissions retain only their earlier project and transcription access; edit or replace them to enable new features. Permissions restrict a credential; they do not change your subscription, team role, project ownership, or available media credits. Administrative team changes remain restricted to the team owner.

​
Header example

This discovery request lists only actions allowed by your key. Do not put an API key in browser code or a public repository.

​
OAuth connections

For compatible assistants, use the remote MCP connection and sign in to VoiceCheap. Review the permissions on the consent screen. You can revoke each connection in Integrations without deleting your API keys.

​
Existing REST endpoints

Existing upload, translation, project, and transcript routes continue to accept API keys and now enforce the appropriate permission. See the API reference for their parameters and the limits for usage rules.