Voice API

progrok exposes Voice REST through the localhost HTTP bridge and provides typed clients for direct xAI WebSockets. The localhost servers do not accept WebSocket upgrades.

SurfaceEndpointAuthentication
TTS, STT, voices, client secretshttp://127.0.0.1:18645/v1/*progrok injects the stored bearer.
Realtime Voicewss://api.x.ai/v1/realtimeServer bearer, or one fresh browser secret per connection.
Streaming STTwss://api.x.ai/v1/sttServer bearer, or one fresh browser secret per connection.
Streaming TTSwss://api.x.ai/v1/ttsServer bearer. Browser ephemeral auth is not verified.

Browser realtime and STT clients mint through same-origin POST /v1/realtime/client_secrets, pass the value only as xai-client-secret.<token> in Sec-WebSocket-Protocol, and discard it after one connection. Every reconnect needs a new secret.