generated: '2026-08-28'
method: searched
source: https://freetts.org/developers
probed: '2026-08-28'
note: >-
  No OpenAPI exists for this provider, so derive-authentication.py had no
  securitySchemes to read. This profile is written from the provider's own
  developer documentation and confirmed against live unauthenticated probes of
  the production API.
summary: >-
  Single-scheme API-key auth. A key is minted in the FreeTTS dashboard under
  "API Keys" and sent as the x-api-key request header. There is no OAuth, no
  OpenID Connect, no mutual TLS, no bearer token and no scope surface, so no
  scopes/ artifact is emitted.
schemes:
- id: apiKeyHeader
  type: apiKey
  in: header
  name: x-api-key
  applies_to:
  - POST /api/v1/tts
  - POST /api/tts-pro
  required: true
  key_prefix: null
  key_prefix_note: >-
    FreeTTS publishes no key prefix convention. Every documented example uses an
    environment variable ($FREETTS_API_KEY) rather than a literal key, so there
    is no example token in the docs to record or to redact.
  issuance: >-
    Free account required; the docs state keys are only issued to accounts with
    a verified email address. Free plan gets 1 key, PRO and Creator up to 10.
    Revoking a key is documented as taking effect instantly.
  rotation: revoke-and-remint from the dashboard; no documented rotation policy
    or key expiry
- id: none
  type: public
  in: null
  name: null
  applies_to:
  - GET /api/voices
  - GET /api/audio/{file_id}
  - GET /api/srt/{file_id}
  - GET /api/health
  required: false
  note: >-
    CONFIRMED BY PROBE. GET https://freetts.org/api/voices returned HTTP 200
    with a 585,024-byte JSON array of 1,410 voice objects and no credential of
    any kind. GET /api/health returned 200 {"status":"ok","timestamp":...}. The
    audio and SRT download endpoints are unauthenticated too and are guarded
    only by the unguessable file_id UUID plus the 1-hour retention window - an
    access-control model worth naming, since a leaked file_id is the whole
    credential for that object until it expires.
probes:
- url: https://freetts.org/api/v1/tts
  method: POST
  headers: none
  status: 401
  body: '{"detail":"Missing x-api-key header"}'
- url: https://freetts.org/api/v1/tts
  method: POST
  headers: 'x-api-key: <deliberately invalid>'
  status: 401
  body: '{"detail":"Invalid API key"}'
- url: https://freetts.org/api/voices
  method: GET
  headers: none
  status: 200
- url: https://freetts.org/api/health
  method: GET
  headers: none
  status: 200
documentation_conflict: >-
  The /developers hero and the About page both advertise the API as "No Key
  Required" / "No API key required to get started", while the same page's FAQ,
  every code sample on it, and the live 401 all require x-api-key. The
  marketing claim is wrong and the FAQ is right. This is worth raising with the
  provider - it is the first thing a developer reads and it is contradicted
  sixty lines later.
transport:
  https_only: true
  tls_version: TLSv1.3
  hsts: true
  hsts_max_age: 63072000
cors:
  enabled: false
  source: >-
    /developers "Technical Notes" states the API does not emit CORS headers by
    default and directs browser callers to proxy through their own backend.