Authentication

Sprio uses two independent authentication schemes, depending on which direction of integration you're building.

Webhook token (inbound: you → Sprio)

When a webhook-based integration (e.g. LeadSquared, Zoho CRM) is configured on your Sprio org, Sprio generates a secret token tied to that specific connection. You configure your system (e.g. your LeadSquared webhook registration) to send this token back on every request, in a custom header.

Sprio validates the token on every incoming webhook call:

POST /api/webhooks/leadsquared/{connectionId}
X-LSQ-Webhook-Token: <your connection's secret token>

• The token is per connection — every integration you connect gets its own.
• If the token is missing or doesn't match, Sprio responds 401 Unauthorized and does not process the event.
• Rotate a compromised token by reconnecting the integration from your Sprio dashboard, which issues a new token.

This scheme currently applies to LeadSquared and Zoho CRM inbound webhooks. See Webhooks for the full contract, and Testing webhooks for runnable examples in several languages.

API key (outbound: Sprio's REST API)

To call Sprio's REST API directly (/v1/* routes — managing assistants, reading calls, etc.), use a Sprio API key.

Authorization: Bearer sprio_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Keys are issued from your Sprio dashboard and shown once at creation — store it securely, Sprio only keeps a hash of it.
• Keys can be scoped with permissions and revoked at any time; a revoked key is rejected immediately on the next request.
• Every key is tied to your organization — requests are automatically scoped to your org's data.

Example request

curl

curl https://api.voice-up.sprio.ai/v1/calls/some-call-id \
  -H "Authorization: Bearer sprio_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

PowerShell

Invoke-RestMethod -Uri "https://api.voice-up.sprio.ai/v1/calls/some-call-id" `
  -Headers @{ Authorization = "Bearer sprio_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" }

Python

import requests

response = requests.get(
    "https://api.voice-up.sprio.ai/v1/calls/some-call-id",
    headers={"Authorization": "Bearer sprio_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
)
print(response.status_code, response.json())

Node.js

const response = await fetch("https://api.voice-up.sprio.ai/v1/calls/some-call-id", {
  headers: { Authorization: "Bearer sprio_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" },
});
console.log(response.status, await response.json());

Error responses

Status	Error code	Meaning
401	missing_api_key	No Authorization: Bearer header sent
401	invalid_api_key_format	Header present but not a sprio_live_... key
401	invalid_api_key	Key not recognized
401	revoked_api_key	Key exists but was revoked

note

The two schemes are independent. A webhook token from your LeadSquared connection will not work as a REST API key, and vice versa.