ElevenLabs
Fronts ElevenLabs audio generation together with the voice/model catalog at https://api.elevenlabs.io; the secret xi-api-key header comes from the gateway. The path following /elevenlabs/ is relayed upstream, restricted to generation POSTs and catalog-read GETs:
Admission is default-deny against a fixed allowlist: the generation POSTs alongside the catalog GETs listed below are what passes, and any other path draws a 404 until the endpoint concerned is added to the allowlist. Kept out: PATCH and DELETE (/v1/convai/agents included), plus the account, workspace, and history reads. Mounted methods: GET, POST.
Common paths
Speech-to-text takes a form
POST /elevenlabs/v1/speech-to-text reads multipart/form-data, not JSON; a JSON body answers 422. Send model_id and either the audio file or, for audio already online, cloud_storage_url:
Over MCP, pass the same fields in call_endpoint’s form. Uploading the file itself needs the direct HTTP call above, with -F file=@clip.mp3.
Credential handling
xi-api-keyis injected as a header; a client-supplied one is overwritten.- An
xi-api-keyquery parameter from the client is discarded (any encoding). Authorizationis removed before the request goes upstream.
Responses (binary audio included)
Nothing is transformed on the way back. Text-to-speech and sound generation yield binary audio (PCM or audio/mpeg), with chunked delivery on the /stream variants; the gateway relays the bytes exactly.
WebSocket / realtime use
No WebSocket endpoint is proxied — bearer gating and forwarding cover plain HTTP alone.
When realtime is needed, obtain a short-lived credential via the gateway first, then open your socket straight against ElevenLabs:
- Call
GET /elevenlabs/v1/convai/conversation/get-signed-urlvia the gateway. - Use the credential it returns to open the WebSocket directly against ElevenLabs.
As before, the master key never lands on the client.
Field-level request and response detail lives in ElevenLabs’ API reference; the gateway modifies neither.

