Tavus API auth: the key goes in the x-api-key header, never in client code

TL;DR

Set the header exactly as x-api-key and keep the key server-side - call Tavus from your backend, not the browser. If you get a 401, first check the header name, then regenerate the key in the developer portal.

Fix

1. Set the header exactly as x-api-key and keep the key server-side - call Tavus from your backend, not the browser. Expected: You get the expected result; the problem is gone.

When to use

• You are setting up or using this Tavus API auth feature.
• The symptom matches: the key goes in the x-api-key header, never in client code.

When NOT to use

• Unrelated Tavus API auth issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against Tavus API auth.

Variant phrasings

the key goes in the x-api-key header, never in client code

Why it happens

Tavus authenticates with an API key created in the PAL Maker, sent on every request in the x-api-key header to https://tavusapi.com (official docs). The docs stress the key is a secret - never expose it in browsers or apps, always load it from environment variables or server-side config. A 401 on Tavus almost always means the header name is wrong (x-api-key, not Authorization) or the key is invalid.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Source: Tavus authenticates with an API key created in the PAL Maker, sent on every request in the x-api-key header to https://tavusapi.com (official docs). The docs stress the key is a secret - never expose it in browsers or apps, always load it from environment variables or server-side config. A 401 on Tavus almost always means the header name is wrong (x-api-key, not Authorization) or the key is invalid.

Verified resolution: Set the header exactly as x-api-key and keep the key server-side - call Tavus from your backend, not the browser. If you get a 401, first check the header name, then regenerate the key in the developer portal.

Source URL: https://docs.tavus.io/llms-full.txt