Skip to main content
TruGen AI uses a two-tier authentication system: API keys for server-side requests and session tokens for client-side connections.

​
Tier 1: API Key

Your API key authenticates server-side requests to the TruGen AI API. API keys can be created and managed from the TruGen AI Dashboard.

​
Creating an API Key

From the API Keys page, click Create API Key, give it a name, and click Create. Copy and store it securely — you will not be able to view it again.
Never expose your API key in a client bundle, script shipped to end users, or public repository. Store it only in server-side environment variables or a secrets manager. If you lose your API key, you will need to create a new one — they cannot be recovered.

​
Tier 2: Session Tokens

Session tokens are temporary JWT credentials (valid for 5 minutes) that let clients connect to TruGen’s streaming infrastructure without exposing your API key.

​
How session tokens work

1

Token Request

Your server requests a session token from TruGen using your API key and agent ID.
2

Token Generation

TruGen generates a temporary JWT tied to that specific agent configuration.
3

Client Connection

Your Python client uses the session token to establish the WebRTC connection.
4

Real-time Communication

Once connected, the client streams video/audio and receives events.

​
Development vs. production

There are two accepted patterns depending on where your Python code runs.

​
Development / trusted environment

For local development, backend jobs, and any environment that already trusts the machine, pass your API key directly to TruGenClient. The SDK handles the token exchange internally on every create_session() call.
This is the pattern used in the Quickstart and the shipped example scripts.

​
Production / shipped desktop apps

If you’re shipping a Python desktop application to end users (Windows/Mac/Linux binaries), do not embed your API key in the binary. Instead:
  1. Run a small server-side endpoint that holds the API key.
  2. Have your desktop app request a short-lived session token from your server.
  3. Use the token to authenticate — see Usage in Production for the full pattern.

​
Environment configuration

Set your credentials in a .env file (loaded via python-dotenv) or export them directly:

​
Next steps

Usage in Production

Ship desktop apps securely with server-side session tokens.

Basic Usage

Full SDK reference for initializing, streaming, and disconnecting.