Authentication

One credential, the GPU API key, covers the text tools on ai.ollalink.com and every Speech GPU capability. Each capability’s page states how to send it.

Which key goes where

Credential	Send it as	Works on
GPU API key (sk_…, created at login.ollalink.com → Platform → GPU API keys)	X-NH-GPU-Key: … header	translation and the text tools on https://ai.ollalink.com and every gpu-*.ollalink.com capability (REST and WebSocket)
Legacy shared Speech GPU key	X-NH-GPU-Key: … header	the same hosts, until 3 November 2026 — switch to your GPU API key

The old gateway partner keys (sk-nhpartner-…, sent as Authorization: Bearer) no longer open anything on ai.ollalink.com; that host now serves translation, the text tools and the models, and takes the GPU API key.

The access header

For translation, the text tools and every speech capability, send:

X-NH-GPU-Key: sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Every call made with the key appears in your dashboard under Usage (calls, audio seconds or characters, errors, per host and per key). A key that is not approved yet returns 403 not_approved; one without GPU access returns 403 forbidden; an unknown key returns 401 unauthorized.

• No separate Bearer token is required — the header is the credential.
• Missing key → HTTP 403 (blocked at the edge, before it reaches any service).
• Paths differ per lane. Some are OpenAI-shaped (gpu-tts serves POST /v1/audio/speech), others expose native routes (ai.ollalink.com serves POST /v1/normalize, POST /v1/embeddings and POST /v1/classify; gpu-asrhq and gpu-transcribe take multipart uploads). There is no /v1/models on any host, so an SDK that probes it will 404 — call the capability’s documented route directly. Each capability page states the exact path.

A first Speech GPU call, end to end:

curl -X POST https://gpu-tts.ollalink.com/v1/audio/speech \
  -H "X-NH-GPU-Key: sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{"input":"BGP peers exchange routes over TCP port 179.","voice":"ryan","language":"en","response_format":"wav"}' \
  --output speech.wav
# -> 200, WAV audio

The same lane works through an OpenAI SDK if you pass the header and call the audio route:

from openai import OpenAI

client = OpenAI(
    base_url="https://gpu-tts.ollalink.com/v1",
    api_key="unused",  # the X-NH-GPU-Key header is the credential
    default_headers={"X-NH-GPU-Key": "sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"},
)

audio = client.audio.speech.create(model="ollalink-tts", voice="ryan",
                                   input="BGP peers exchange routes over TCP port 179.")
audio.write_to_file("speech.mp3")   # mp3 is the default format on this route

A 403 can also mean your HTTP client, not your key

The edge rejects some automated-client signatures. Most notably, Python’s standard library urllib.request is blocked — its default User-Agent (Python-urllib/3.x) returns 403 even with a perfectly valid key, which is indistinguishable from an auth failure.

requests, httpx, the OpenAI SDK, curl and browsers are all fine. If you must use urllib, set a User-Agent header of your own.

Key handling

• Keys are issued per partner and independently revocable — a leaked key is rotated for you alone; no other partner is affected.
• Never embed a key in client-side / browser / mobile code. Call from your backend only.
• Do not share or proxy your key to third parties.
• To rotate, revoke, or raise limits, contact your ollalink technical contact — rotation is instant and scoped to you.

Error codes

Code	Meaning
200	OK
400	Malformed request, an unsupported language or voice, or input over the limit
401	Unknown key (unauthorized)
403	Missing access header, a key not yet approved (not_approved) or without GPU access (forbidden)
404	Wrong path for that capability
410	A route switched off on this host; the message names the routes that are served
429	Rate limited — see Rate limits below
502 / 503	A capability is busy, restarting or loading — retry shortly with back-off
5xx	Upstream error

Error bodies are JSON with an error field.

Repeated auth failures

Stop and fix auth on the first 401 / 403; a rejected key stays rejected, so retrying it in a loop only adds load. Every failure is a clean HTTP status.

Rate limits

Every host is rate-limited at the edge. Limits are generous — normal interactive use won’t hit them — and over-limit requests return HTTP 429. Back off and retry.

Service	Limit	Scope
Text tools and Speech GPU (ai.ollalink.com, gpu-*.ollalink.com, X-NH-GPU-Key)	600 requests / 60 s	per API key

• A long job or a WebSocket session counts as one request against the limit.
• Keep your key to your own backend, and pace requests steadily.
• Need a higher ceiling for a launch or batch job? Ask your ollalink contact and we’ll raise it.

Concurrent sessions

Separately from the request rate above, the two WebSocket lanes — live captions (gpu-live) and realtime speech-to-text (gpu-asr) — share capacity across every caller.

• When it is full, a new session is refused immediately with a busy error frame and close code 1013. It is not queued — retry with back-off rather than in a tight loop.
• Sessions count while the socket is open, so close them when a speaker leaves. Sessions have no time limit.

Routing

See Speech routing for endpoint-specific finalization and translating captions.