Deepgram

Overview

Use Deepgram credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Template ID	deepgram
Category	AI
Credential Type	API Key

Step 1: Get Credentials

Log in to the Deepgram Console

Log in to the Deepgram Console at console.deepgram.com.

Open API Keys

Select a project and open API Keys under Manage.

Create a key

Click Create API Key, name it, choose the Member role unless the integration manages the project, and set an expiration.

Copy the key

Copy the key — it is only shown once.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Deepgram

Go to Managed Secrets > Add Provider > Deepgram.

Enter credentials

Paste the API Key into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://api.deepgram.com/v1/listen",
    grant_id="YOUR_GRANT_ID",
    json={"url": "https://example.com/audio.wav"},
)

Notes

• The key is injected as Authorization: Token <key> (Deepgram’s non-Bearer scheme).
• Member is the least-privileged console role. Transcription needs only the usage:write scope; a key limited to that scope can be created through Deepgram’s Keys API.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
transcribe	read	POST	/v1/listen	—
analyze	read	POST	/v1/read	—
post:/v1/speak	read	POST	/v1/speak	also accepts generate
grant	admin	POST	/v1/auth/grant	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
create	write	POST	/v1/projects/{project_id}/agents	—
get	read	GET	/v1/projects/{project_id}/agents/{agent_id}	—
update	write	PUT	/v1/projects/{project_id}/agents/{agent_id}	—
delete	delete	DELETE	/v1/projects/{project_id}/agents/{agent_id}	—
get:/v1/agent/settings/think/models	read	GET	/v1/agent/settings/think/models	also accepts list
leave	admin	DELETE	/v1/projects/{project_id}/leave	—
keys_create	admin	POST	/v1/projects/{project_id}/keys	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
distributionCredentials_create	admin	POST	/v1/projects/{project_id}/self-hosted/distribution/credentials	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)