API keys

A key looks like imk_ followed by 43 random characters — 256 bits of randomness. We store only a hash of it, so nobody at InlineMeet can read it back, and we show it to you exactly once, when it’s created.

#Which plans include keys

API keys are what embedding runs on, so they come with the paid plans. On Free, the API keys page offers an upgrade instead; everything else in these docs — the demos and the playground — works without one.

See every plan. If a subscription ends, its keys stop working until the workspace is on a paid plan again — they aren’t deleted.

#Create a key

#Store it safely

Treat the key like a database password: in an environment variable or a secrets manager, read only by your server.

# A local .env file (and make sure .env is in .gitignore)
INLINEMEET_API_KEY=imk_…

# Vercel
vercel env add INLINEMEET_API_KEY production

# Fly.io
fly secrets set INLINEMEET_API_KEY=imk_…

#Use it

Send it on every request as a bearer token. GET /v1/usage is a harmless way to check a key works — it returns this month’s usage:

curl https://api.inlinemeet.com/v1/usage \
  -H "Authorization: Bearer $INLINEMEET_API_KEY"

{
  "period": "2026-09",
  "participantMinutes": 0,
  "participantSessions": 0,
  "storedGb": 0
}

Most apps wrap it once, and call the wrapper everywhere:

const API = 'https://api.inlinemeet.com/v1';

/** Calls the InlineMeet API with your key. Server-side only. */
export async function inlinemeet<T = any>(path: string, init: RequestInit = {}): Promise<T> {
  const res = await fetch(`${API}${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${process.env.INLINEMEET_API_KEY}`,
      'Content-Type': 'application/json',
      ...init.headers,
    },
  });
  const body = await res.json();
  if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message}`);
  return body;
}

// const room = await inlinemeet('/rooms', { method: 'POST', body: JSON.stringify({ code: 'algebra-101' }) });

#Rotate without downtime

Replace a key — on a schedule, or when someone who had access leaves — with no moment where calls can’t start:

1. Create a new key with the same label and a date, like production 2026-09.
2. Deploy it to your servers alongside, or in place of, the old one.
3. Watch Last used on the API keys page: once the new key shows traffic and the old one stops, you’re done.
4. Revoke the old key.

#Revoke a key

Revoking is immediate: the next request with that key gets 401 unauthorized. Calls already in progress carry on — they run on join tokens, not on your key — but no new tokens can be minted with it. Revoked keys stay listed, greyed out, so you can see what existed.

#When a key is refused

Every error has the same shape, so one handler covers them all — see Errors.

#Security checklist

• The key lives only in server-side environment variables or a secrets manager.
• One key per environment, labelled, so each can be replaced on its own.
• Your token route checks who the user is, and what they may do, before minting anything.
• Keys are rotated when people with access leave — it takes five minutes.
• Logs never print the Authorization header.