Authentication

All API requests require authentication via a Bearer token using an API key.

Getting an API Key

Log in to the Vonative Dashboard
Go to DEVELOPER → API Keys
Click Create API Key
Enter a name (e.g., “Production API Key”)
Copy the key immediately — it won’t be shown again

Key Format

API keys use the prefix sk_vlang_ followed by a random string:

sk_vlang_2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p

Older keys may use the key_ prefix. Both formats are supported. The key is SHA-256 hashed before storage — Vonative cannot recover your key if lost.

Using Your API Key

Include the key in the Authorization header:

curl -X GET https://api.vonative.com/v1/assistants/ \
  -H "Authorization: Bearer sk_vlang_2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p"

API Key Scoping

API keys are scoped to your organization. All resources (assistants, phone numbers, calls) are automatically filtered to your org.

Allowed Endpoints

API keys can access the following resource groups:

Prefix	Resource
`/v1/assistants`	AI voice assistants
`/v1/workflows`	Call flow workflows
`/v1/calls`	Call management and analytics
`/v1/phone-numbers`	Phone number management
`/v1/files`	File and knowledge base management
`/v1/tools`	Tool/function definitions
`/v1/sessions`	Call session management
`/v1/call-logs`	Call log and event history
`/v1/webhooks`	Outbound webhook configuration
`/v1/campaigns`	Outbound calling campaigns
`/v1/call-analysis`	Call analysis profiles and rerun analysis
`/v1/integrations/server-credentials`	Server credential management

Requests to endpoints outside these prefixes require session-based authentication.

Rate Limits

Limit	Value
Requests per minute	100 per API key
Concurrent calls	Varies by plan (Build: 5, Growth: 10, Scale: 25)

Rate limit response:

{
  "success": false,
  "error": {
    "message": "Rate limit exceeded. Try again in 12 seconds.",
    "code": "RATE_LIMITED"
  }
}

Error Responses

Status	Meaning
`401`	Missing or invalid API key
`403`	API key not allowed for this endpoint
`429`	Rate limit exceeded

{
  "success": false,
  "error": {
    "message": "Invalid or expired API key",
    "code": "UNAUTHORIZED"
  }
}

Security Best Practices

Never expose your API key in client-side code, public repositories, or logs.

Store keys in environment variables or a secrets manager
Rotate keys periodically
Use separate keys for development and production
Revoke compromised keys immediately via the dashboard

Authentication

Introduction

Assistants

Phone Numbers

Workflows

Calls

Files

Tools

Server Credentials

Sessions

Call Logs

Webhooks

Campaigns

Authentication

Authentication

Getting an API Key

Key Format

Using Your API Key

API Key Scoping

Allowed Endpoints

Rate Limits

Error Responses

Security Best Practices

​Authentication

​Getting an API Key

​Key Format

​Using Your API Key

​API Key Scoping

​Allowed Endpoints

​Rate Limits

​Error Responses

​Security Best Practices

Authentication

Getting an API Key

Key Format

Using Your API Key

API Key Scoping

Allowed Endpoints

Rate Limits

Error Responses

Security Best Practices