Deepgram Authentication: API Key Setup and Security (2026)

Authentication overview

Deepgram provides programmatic access to its suite of AI models, including speech-to-text, text-to-speech, and audio intelligence features, through a RESTful API. Authentication is a prerequisite for all API requests, ensuring that only authorized entities can access and utilize these services. Deepgram's authentication mechanism relies on API keys, which are unique, secret strings used to verify the identity of the client making the request. These keys are associated with a Deepgram project and possess specific permissions, dictating which API endpoints and resources they can access.

When an application sends a request to the Deepgram API, the API key is included in the request header. The Deepgram API then validates this key against its records. If the key is valid and has the necessary permissions for the requested operation, the API processes the request. If the key is invalid, expired, or lacks sufficient permissions, the API rejects the request, typically returning an HTTP 401 Unauthorized or 403 Forbidden status code. This design ensures that only authenticated and authorized requests proceed, safeguarding both the user's data and Deepgram's infrastructure. For detailed information on API endpoints and request formats, consult the Deepgram API reference documentation.

Supported authentication methods

Deepgram primarily supports API key authentication. This method is common for web services due to its simplicity and effectiveness for securing programmatic access. API keys function as bearer tokens, which means that whoever possesses the token can use it to access the associated resources. This makes secure handling of API keys critical.

The following table outlines the key authentication method:

While API keys are the primary method, developers integrating Deepgram into larger systems might employ additional layers of security. For instance, in a microservices architecture, an API gateway (e.g., Kong Gateway) could be used to enforce rate limiting, IP whitelisting, or introduce client certificate authentication before requests even reach the Deepgram API. However, the direct authentication with Deepgram always relies on the provided API key.

It is important to note that Deepgram's authentication does not currently support OAuth 2.0 or OpenID Connect for directly authenticating end-users, as its primary use case is server-side or application-level access rather than delegating user consent. For applications requiring user authentication, developers typically handle user authentication within their own application infrastructure and use a Deepgram API key for backend interactions.

Getting your credentials

To obtain Deepgram API keys, you must first create a Deepgram account. Upon successful account creation, API keys can be generated and managed directly within the Deepgram Console, which serves as the central hub for project administration, usage monitoring, and credential management. Each account can have multiple projects, and each project can have multiple API keys, allowing for granular control over access and permissions.

1. Sign Up/Log In: Navigate to the Deepgram website and either sign up for a new account or log in to your existing one.
2. Access the Console: After logging in, you will be directed to the Deepgram Console.
3. Navigate to API Keys: Within the console, locate the 'API Keys' section, typically found in the navigation menu or dashboard overview.
4. Create a New Key: Click on the 'Create New API Key' button. You will be prompted to provide a descriptive name for your key. This name helps you identify the key's purpose later (e.g., 'Production Backend Key', 'Development Frontend Key').
5. Copy the Key: Once created, Deepgram will display your API key. It is crucial to copy this key immediately and store it securely, as it will only be shown once for security reasons. If lost, you will need to generate a new key.

Deepgram API keys are associated with a specific project. This means that keys generated for one project will not work for another. The Deepgram Console also allows you to manage existing keys, including revoking them if they are compromised or no longer needed. Regular review and rotation of API keys are recommended security practices.

Authenticated request example

Authenticating requests to the Deepgram API involves including your API key in the Authorization header of your HTTP request. The key should be prefixed with Token (note the space after Token). This is a standard practice for bearer token authentication.

HTTP Header Structure

Authorization: Token YOUR_DEEPGRAM_API_KEY

Example using cURL

This cURL example demonstrates how to send an audio file for transcription using the Deepgram API, authenticated with your API key:

curl -X POST \
  'https://api.deepgram.com/v1/listen?model=general' \
  -H 'Authorization: Token YOUR_DEEPGRAM_API_KEY' \
  -H 'Content-Type: audio/wav' \
  --data-binary '@/path/to/your/audio.wav'

Replace YOUR_DEEPGRAM_API_KEY with your actual Deepgram API key and /path/to/your/audio.wav with the path to your audio file.

Example using Python SDK

Deepgram provides SDKs for various programming languages, simplifying the authentication process. Here's an example using the Python SDK:

import os
from deepgram import DeepgramClient, DeepgramClientOptions, LiveTranscriptionEvents, CreateProjectKeyOptions

# Ensure your API key is stored securely, e.g., in an environment variable
DEEPGRAM_API_KEY = os.getenv("DEEPGRAM_API_KEY")

if not DEEPGRAM_API_KEY:
    raise ValueError("DEEPGRAM_API_KEY environment variable not set")

# Initialize the Deepgram client with your API key
dg_client = DeepgramClient(DEEPGRAM_API_KEY)

# Example: Transcribing a local file
AUDIO_FILE = "./your_audio.wav"

with open(AUDIO_FILE, "rb") as file:
    buffer_data = file.read()

source = {
    "buffer": buffer_data,
    "mimetype": "audio/wav"
}

response = dg_client.listen.prerecorded.v("1").transcribe_file(source)
print(response.to_json(indent=4))

# Example: Transcribing a live stream (real-time)
# from deepgram import LiveOptions
# live_connection = dg_client.listen.live.v("1").create_connection()

# def on_message(self, result):
#     if result.channel.alternatives[0].transcript:
#         print(result.channel.alternatives[0].transcript)

# live_connection.on(LiveTranscriptionEvents.Transcript, on_message)

# options = LiveOptions(punctuate=True, language="en-US")
# live_connection.start(options)

# # Simulate sending audio (in a real app, this would come from a microphone or stream)
# # For testing, you might read from a file in chunks
# # live_connection.send(audio_chunk)

# # To close the connection
# # live_connection.finish()

This Python example demonstrates setting up the client with an API key sourced from an environment variable, a recommended security practice. The Deepgram Get Started guide provides similar examples for other supported SDKs like Node.js, Go, and Ruby.

Security best practices

Protecting your Deepgram API keys is essential to prevent unauthorized access, potential misuse of your account, and unexpected charges. Adhering to security best practices for API key management is crucial.

• Never embed API keys directly in code: Hardcoding API keys in your source code is a significant security risk. If your code repository becomes public or is compromised, your keys will be exposed.
• Use Environment Variables: For server-side applications, store your API keys in environment variables (e.g., DEEPGRAM_API_KEY). This keeps them separate from your codebase and allows for easy rotation without code changes. Most modern deployment platforms support environment variables.
• Utilize Secret Management Services: For production environments, consider using dedicated secret management services like AWS Secrets Manager, Google Cloud Secret Manager, or Azure Key Vault. These services provide secure storage, automatic rotation, and fine-grained access control for your credentials. For more on secure secret storage, you can review Google Cloud's secrets management documentation.
• Do Not Commit Keys to Version Control: Ensure your .gitignore file (or equivalent for your version control system) excludes any files that might contain API keys, such as .env files or configuration files.
• Restrict Key Permissions: If Deepgram offered granular key permissions (which it may in the future), generate keys with only the minimum necessary permissions for the tasks they perform. This limits the damage if a key is compromised.
• Regularly Rotate Keys: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. A common rotation schedule is every 90 days.
• Monitor API Usage: Regularly check your Deepgram Console for unusual API usage patterns. Spikes in requests or usage from unexpected regions could indicate a compromised key.
• Implement IP Whitelisting (if available): If Deepgram were to offer IP whitelisting, configure your API keys to only accept requests from specific, trusted IP addresses. This adds an extra layer of security.
• Secure Client-Side Applications: For client-side applications (e.g., front-end web apps), direct exposure of API keys is generally discouraged. If direct client-side access is unavoidable, consider using a proxy server to mediate requests, or explore alternative authentication patterns that do not expose the raw API key to the client.
• Encrypt Data in Transit: Always use HTTPS/TLS for all communication with the Deepgram API to ensure that your API keys and data are encrypted during transit, preventing eavesdropping. Deepgram API endpoints are only accessible over HTTPS.