The websocket subprotocols the browser authenticates with: the OpenAI Realtime realtime
protocol, plus the server-minted client secret in the openai-insecure-api-key. slot. This is
the exact pair the openai SDK sends, and ElevenLabs' compatibility guide says to hand that SDK
the client secret as its API key. Browsers cannot set a handshake Authorization header, so the
subprotocol is the only channel; no ElevenLabs API key ever reaches the browser.
The websocket subprotocols the browser authenticates with: the OpenAI Realtime
realtimeprotocol, plus the server-minted client secret in theopenai-insecure-api-key.slot. This is the exact pair theopenaiSDK sends, and ElevenLabs' compatibility guide says to hand that SDK the client secret as its API key. Browsers cannot set a handshakeAuthorizationheader, so the subprotocol is the only channel; no ElevenLabs API key ever reaches the browser.