generated: '2026-08-26'
method: searched
source: https://docs.mthreads.com/asr/recording-recognition/introduction
name: Moore Threads Authentication Profile
description: >-
  Every public Moore Threads API surface is bearer/opaque-token authenticated. There is no OAuth 2.0
  authorization server, no OpenID Connect discovery document, no scope model and no mTLS on any
  published surface. Two distinct token issuance paths exist and they are not interchangeable: the
  AIBook speech APIs issue an Access Token by human request to named Moore Threads staff, while the
  KUAE Cloud Coding Plan issues a self-service API Key from a console after a plan is redeemed.
schemes:
- id: aibook-tts-authorization-header
  api: Moore Threads AIBook Text-to-Speech API
  type: http
  scheme: bearer-like
  location: header
  parameter: Authorization
  format: 'Authorization: {ACCESS_TOKEN}'
  note: >-
    The published curl sample sends the raw token in the Authorization header with no "Bearer"
    prefix. The streaming WebSocket variant instead carries an access_token field inside the JSON
    request body, documented as "not yet enforced — send the default value default_token".
  docs: https://docs.mthreads.com/tts/unary-tts/introduction
- id: aibook-tts-stream-body-token
  api: Moore Threads AIBook Text-to-Speech API
  type: apiKey
  location: body
  parameter: access_token
  note: >-
    WebSocket /api/v2/tts/stream_generate. Docs state the field is currently inert and a literal
    placeholder value is accepted, which means the streaming TTS endpoint is documented as
    effectively unauthenticated at the protocol level.
  docs: https://docs.mthreads.com/tts/stream-tts/introduction
- id: aibook-asr-bearer
  api: Moore Threads AIBook Speech Recognition API
  type: http
  scheme: bearer
  location: header
  parameter: Authorization
  format: 'Authorization: Bearer {your_access_token}'
  note: The recording-file HTTP API is the only surface documenting a conventional RFC 6750 Bearer header.
  docs: https://docs.mthreads.com/asr/recording-recognition/introduction
- id: aibook-asr-ws-query-token
  api: Moore Threads AIBook Speech Recognition API
  type: apiKey
  location: query
  parameter: token
  format: wss://aibook-api.mthreads.com:62220/api/v1/asr?token=${your_token}
  note: >-
    Realtime ASR passes the credential in the URL query string. Tokens in URLs are logged by
    proxies and appear in browser/server history — a documented weakness of this surface.
  docs: https://docs.mthreads.com/asr/realtime-recognition/introduction
- id: aibook-vc-ws-query-token
  api: Moore Threads AIBook Streaming Voice Conversion API
  type: apiKey
  location: query
  parameter: token
  format: wss://aibook-api.mthreads.com:32314/api/v1/streaming_vc?token=${your_token}
  docs: https://docs.mthreads.com/vc/stream-vc/introduction
- id: kuae-coding-plan-api-key
  api: KUAE Cloud Coding Plan API
  type: apiKey
  location: header
  parameter: Authorization / x-api-key
  format: >-
    Supplied to clients as ANTHROPIC_AUTH_TOKEN (Anthropic protocol) or as the OpenAI-compatible
    API key. The wire header is whatever the client SDK sends; Moore Threads documents only the
    environment-variable name, not the header.
  note: >-
    Self-service. Created at https://coding-plan.kuaecloud.net/apikey after a plan is applied for
    or redeemed. Docs warn against embedding the key in source and recommend environment
    variables. An incorrect key returns a JSON error with type "Unauthorized" and code
    "AuthenticationError".
  docs: https://docs.mthreads.com/kuaecloud/kuaecloud-doc-online/coding_plan/user_guide
token_issuance:
- surface: AIBook speech APIs (TTS, ASR, VC)
  model: contact-sales
  detail: >-
    "访问令牌（Access Token）请联系我们获取" — every AIBook API reference page names two Moore Threads
    individuals as the issuance channel rather than a signup flow. There is no self-service key page.
  evidence: https://docs.mthreads.com/tts/unary-tts/introduction
- surface: KUAE Cloud Coding Plan
  model: self-service-after-purchase
  detail: >-
    Register on coding-plan.kuaecloud.net, claim a 30-day Free Trial or redeem a code purchased on
    the JD storefront, then mint an API key in the console.
  evidence: https://docs.mthreads.com/kuaecloud/kuaecloud-doc-online/coding_plan/user_guide
not_found:
- oauth2
- openid-connect
- mutual-tls
- api-key-rotation-policy
- scopes