Authenticated resource reads are available. A browser conversation still requires a released session and transport path. This guide does not install a Threetone client package or start a live session.
Before you begin
Use the TypeScript REST example for the server request and review web deployment. Choose an existing agent and authorize access to it in your application.Prepare the interface
1
Keep the API key on your server
Store
THREETONE_API_KEY in the server environment. In a Vite application, do not put it in a variable prefixed with VITE_. Those values become part of the browser bundle. A public API base URL is configuration; a workspace key is a credential.2
Return a small authorized response
Authenticate the caller before reading private agent configuration. Use Get agent on the server and return only fields the interface needs. Do not expose an arbitrary resource proxy that accepts any agent ID without checking access.
3
Handle request failures
Show loading, unavailable, and retry states. Cancel obsolete requests when the user changes the selected agent. Avoid putting private responses in a shared public cache, and keep credentials and prompt contents out of browser error messages.
4
Prepare a future session lifecycle
Start microphone access only after an explicit user action. Include stop and mute controls with accessible labels. Plan for permission denial, disconnection, and cleanup when the page closes. Keep these controls unavailable until the supported session path is ready.
Frequently asked questions
Can I hide a workspace key in a minified bundle?
Can I hide a workspace key in a minified bundle?
No. Anyone who receives the bundle can inspect its values and requests. Keep privileged operations on an authorized server.
Is a resource read enough to enable chat or voice?
Is a resource read enough to enable chat or voice?
No. Reading an agent document and establishing a conversation are separate operations. Check current availability before enabling a live control.