Mint a Realtime session on your server

Keep the permanent key on the server#

Create sessions only in authenticated server routes. Return the descriptor with Cache-Control: no-store; never return the permanent API key. Select ox/voice-agent for a conversational agent that can call customer functions while the microphone remains live.

const session = await ox.realtime.sessions.create({
  model: "ox/voice-agent",
  transport: "websocket",
  session: {
    instructions: "Help customers schedule service. Confirm before booking.",
    endpointing: { eagerness: "medium" },
  },
});

return Response.json(session, {
  headers: { "Cache-Control": "no-store" },
});

Return a short-lived descriptor#

The lower-level HTTP contract is POST https://www.amerint.co/v1/realtime/sessions with Authorization: Bearer $OX_API_KEY. A returned session secret is short-lived, single-use, and still sensitive.