Security and authentication

Live Hub is the client in the bot and speech provider APIs, so it is Live Hub that has to prove itself to your service. It does that by sending a bearer token on every request: either a token you supply, which Live Hub sends unchanged, or one it fetches from your authorization server and renews.

You choose between the two, and supply the values, on the Live Hub side. Nothing here is configured in your own code beyond checking the token you receive.

Transport

Use HTTPS for your service's URLs. Plain HTTP works, but restrict it to test environments.

You can configure Live Hub to accept a self-signed certificate from your service, where a properly signed one is not available. For a speech provider, the settings that do so are 'Allow self-signed certificate for TTS' and 'Allow self-signed certificate for STT'. See Custom integration speech provider.

Permanent token authentication

Live Hub sends a fixed token you configure, unchanged, on every request:

Authorization: Bearer {token}

Your service checks the value to confirm that the caller is Live Hub. Where you set it depends on what you are implementing:

Your service	Where the token goes
A bot, over the Bot API	On the bot connection: from the 'Authentication method' list, select Permanent token, and then enter the token in the 'Token' field. See AudioCodes Bot API.
A speech-to-text or text-to-speech service	On the speech provider, in the 'Authentication Key' field. See Custom integration speech provider.

If your service authenticates some other way, or not at all, leave the token empty. Live Hub then sends no Authorization header. On a bot connection this is the No authentication option.

OAuth 2.0 authentication

Rather than a fixed token, Live Hub can obtain a short-lived one from an authorization server you nominate, using the client credentials grant. Live Hub is the client; the authorization server identifies it by the client ID and secret you issue it, and optionally by scope.

Configure it on the bot connection: from the 'Authentication method' list, select OAuth2.0, and then enter values in 'OAuth token URL', 'OAuth client ID', and 'OAuth client secret'. If your authorization server expects scopes, also enter 'OAuth scopes'. See AudioCodes Bot API.

Live Hub then sends the access token it received on every request to your service, in the same Authorization: Bearer header as a permanent token. Your service cannot tell the two apart, and does not need to.

Live Hub renews the token automatically. One token serves every call on that bot connection until it expires, and about 30 seconds before expiry Live Hub requests a new one. If the token expires and no new one can be obtained, calls in progress are terminated and no new calls are accepted until the authorization server responds again.