Authentication

Cloud authentication

Cloud requests use bearer authentication:

Authorization: Bearer vued_live_...

Public clients use public API keys:

Token	Use
Public API key	`vued_live_...` key scoped to one org and explicit scopes.

Vued first-party apps use signed-in sessions internally to create and manage keys. Most cloud routes are organization-scoped:

/v1/orgs/{org_id}/...

For cloud methods and explicit overrides, standard public API keys resolve their org automatically in the SDK:

client = Vued(api_key="vued_live_...")

Public API key scopes

Scope	Grants
`records:read`	Read fallback for meetings, transcripts, files, speakers, rooms, and users.
`meetings:read`	Meeting audio and semantic meeting references.
`transcripts:read`	Semantic search and transcript audio.
`files:read`	File and folder reads and grants.
`files:write`	File and folder create, update, grant, and revoke.
`speakers:read`	Speaker profile reads.
`rooms:read`	Room and microphone reads.
`rooms:write`	Room create and update.
`users:read`	Organization user reads.
`webhooks:read`	Webhook reads.
`webhooks:write`	Webhook create, update, and delete.
`api_keys:read`	Public API key reads.
`api_keys:write`	Public API key create and revoke.
`org:<org_uuid>`	Added by Vued to bind each public API key to one org.

Local runtime authentication

Vued Desktop and Vued headless both write a local discovery file that contains the local API URL and a runtime bearer token. They also create and store a scoped local SDK key for decrypted local reads. The Python SDK reads discovery automatically, so Vued().search(...) works after either Desktop or headless setup. Headless setup signs in through https://vued.ai/cli-auth, stores a refresh token securely when available, and asks for the Vued encryption passphrase so encrypted sync can decrypt locally. The daemon refreshes expired Vued sessions automatically on cloud 401. If refresh requires user action, vued status, vued doctor, and SDK local errors surface an auth-required state and the user should run vued setup --reset. Discovery order:

VUED_LOCAL_API_URL plus VUED_LOCAL_API_TOKEN
VUED_LOCAL_API_DISCOVERY
OS app-support local-api.json under Vued Dev, Vued, vued-web, or legacy Electron

Discovery file shape:

{
  "host": "127.0.0.1",
  "port": 39391,
  "pid": 12345,
  "version": 1,
  "profile": "prod",
  "runtime": "headless",
  "dataDir": "/Users/alex/Library/Application Support/Vued",
  "authToken": "run-local-secret",
  "startedAt": 1782345600000
}

SDK telemetry

The Python SDK sends SDK identity headers on requests and reports aggregate local-call telemetry back to the cloud after local runtime calls. Telemetry includes route shape, status, duration, SDK version/runtime/platform, org, API key, and user metadata when available. It does not include decrypted transcript text, file names, search query text, or local runtime bearer tokens. Disable SDK telemetry with either:

client = Vued(api_key="vued_live_...", telemetry=False)

or:

export VUED_TELEMETRY_DISABLED=1

Never commit public API keys, local runtime tokens, webhook secrets, OAuth tokens, refresh tokens, encryption passphrases, or .env files.

Get Started

MCP

Headless CLI

Docs Ops

API Reference

Webhooks

Cloud authentication

Public API key scopes

Local runtime authentication

SDK telemetry

​Cloud authentication

​Public API key scopes

​Local runtime authentication

​SDK telemetry

Cloud authentication

Public API key scopes

Local runtime authentication

SDK telemetry