WebSockets

WebSocket connections, such as OpenAI's Realtime API, go through Vallkey too. Allow GET /v1/realtime in the key's rules. Servers send the ghost key as a Bearer token; browsers, which cannot set headers, send it in the openai-insecure-api-key. subprotocol. The model in ?model= is checked against allowedModels, and token usage reported during the session counts toward the daily token cap: the session is closed once the cap is reached.

From a web page, the key needs your website in its allowed websites, and the page should use a short-lived key made by your server rather than the ghost key itself.