@elevenlabs/elevenlabs-js 2.55.0 → 2.56.0

package/BaseClient.js

@@ -41,8 +41,8 @@ function normalizeClientOptions(options) {
     const headers = (0, headers_1.mergeHeaders)({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "@elevenlabs/elevenlabs-js",
-        "X-Fern-SDK-Version": "2.55.0",
-        "User-Agent": "@elevenlabs/elevenlabs-js/2.55.0",
+        "X-Fern-SDK-Version": "2.56.0",
+        "User-Agent": "@elevenlabs/elevenlabs-js/2.56.0",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
         "xi-api-key": options === null || options === void 0 ? void 0 : options.apiKey,

package/README.md

@@ -178,6 +178,23 @@ server.start();
 
 Both `SpeechEngine.Server` and `speechEngine.attach()` automatically verify the `X-Elevenlabs-Speech-Engine-Authorization` header on every incoming connection, rejecting any requests that were not signed by ElevenLabs. The API key is read from `apiKey` in the options or the `ELEVENLABS_API_KEY` environment variable.
 
+#### Disabling authentication
+
+If you're running behind an infrastructure layer that already restricts incoming traffic to ElevenLabs (typically an IP allowlist scoped to [ElevenLabs' egress ranges](https://elevenlabs.io/docs/overview/capabilities/speech-engine#ip-allowlisting)), you can skip JWT verification by passing `disableAuth: true`:
+
+```ts
+// Standalone — no apiKey required when disableAuth is true
+new SpeechEngine.Server({ port: 3001, disableAuth: true, onTranscript }).start();
+
+// Or on attach
+elevenlabs.speechEngine.attach("seng_123", httpServer, "/api/speech-engine/ws", {
+    disableAuth: true,
+    onTranscript,
+});
+```
+
+When auth is disabled the server accepts any client that can reach it and logs a `console.warn` on startup. **Only use this if you have an IP allowlist or equivalent network-level restriction in front of the server** — without one, anyone on the internet can open a session and consume your compute and downstream LLM quota.
+
 ### Session events
 
 | Event | Method | Description |

package/dist/BaseClient.js

@@ -41,8 +41,8 @@ function normalizeClientOptions(options) {
     const headers = (0, headers_1.mergeHeaders)({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "@elevenlabs/elevenlabs-js",
-        "X-Fern-SDK-Version": "2.55.0",
-        "User-Agent": "@elevenlabs/elevenlabs-js/2.55.0",
+        "X-Fern-SDK-Version": "2.56.0",
+        "User-Agent": "@elevenlabs/elevenlabs-js/2.56.0",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
         "xi-api-key": options === null || options === void 0 ? void 0 : options.apiKey,

package/dist/wrapper/speech-engine/SpeechEngineResource.js

@@ -111,9 +111,14 @@ class SpeechEngineResource {
      * ```
      */
     attach(httpServer, path, handler) {
-        var _a;
+        var _a, _b;
         const debug = (_a = handler.debug) !== null && _a !== void 0 ? _a : false;
+        const disableAuth = (_b = handler.disableAuth) !== null && _b !== void 0 ? _b : false;
         const log = debug ? (...args) => console.log("[SpeechEngine]", ...args) : () => { };
+        if (disableAuth) {
+            console.warn("[SpeechEngine] authentication is disabled on attach() — incoming connections will NOT be verified. " +
+                "Make sure the server is protected by either IP allowlist restricting traffic to ElevenLabs or using custom header values.");
+        }
         const wss = new ws_1.default.Server({ noServer: true });
         const upgradeListener = (req, socket, head) => __awaiter(this, void 0, void 0, function* () {
             var _a;
@@ -123,14 +128,19 @@ class SpeechEngineResource {
                 log(`path mismatch: expected ${path}, got ${url.pathname} — skipping`);
                 return;
             }
-            if (!(yield this.verifyRequest(req))) {
+            if (disableAuth) {
+                log("auth disabled, upgrading connection without verification");
+            }
+            else if (!(yield this.verifyRequest(req))) {
                 // verifyRequest returned false — get the detailed reason for debug logging
                 const reason = yield this.getVerificationFailure(req);
                 log(`rejected connection — ${reason}`);
                 socket.destroy();
                 return;
             }
-            log("upgrading connection to WebSocket");
+            else {
+                log("upgrading connection to WebSocket");
+            }
             wss.handleUpgrade(req, socket, head, (ws) => {
                 log("WebSocket connection established");
                 wss.emit("connection", ws);

package/dist/wrapper/speech-engine/SpeechEngineServer.js

@@ -39,36 +39,50 @@ class SpeechEngineServer {
      * Start the standalone WebSocket server on the configured port.
      */
     start() {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         if (this.wss) {
             throw new Error("Server is already started");
         }
-        const apiKey = (_a = this.options.apiKey) !== null && _a !== void 0 ? _a : process.env.ELEVENLABS_API_KEY;
-        if (!apiKey) {
+        const disableAuth = (_a = this.options.disableAuth) !== null && _a !== void 0 ? _a : false;
+        const apiKey = (_b = this.options.apiKey) !== null && _b !== void 0 ? _b : process.env.ELEVENLABS_API_KEY;
+        if (!apiKey && !disableAuth) {
             throw new Error("SpeechEngine.Server requires an API key to verify incoming connections. " +
-                "Pass { apiKey: \"...\" } or set the ELEVENLABS_API_KEY environment variable.");
+                "Pass { apiKey: \"...\" } or set the ELEVENLABS_API_KEY environment variable. " +
+                "To run without authentication, pass { disableAuth: true } — but only behind an IP allowlist.");
         }
-        const debug = (_b = this.options.debug) !== null && _b !== void 0 ? _b : false;
+        const debug = (_c = this.options.debug) !== null && _c !== void 0 ? _c : false;
         const log = debug ? (...args) => console.log("[SpeechEngine]", ...args) : () => { };
+        if (disableAuth) {
+            console.warn("[SpeechEngine] authentication is disabled — incoming connections will NOT be verified. " +
+                "Make sure the server is protected by an IP allowlist restricting traffic to ElevenLabs.");
+        }
         const httpServer = (0, node_http_1.createServer)();
         const wss = new ws_1.default.Server({ noServer: true });
+        const verifyToken = disableAuth
+            ? null
+            : (token) => (0, SpeechEngineResource_1.verifySpeechEngineJwt)(token, apiKey);
         httpServer.on("upgrade", (req, socket, head) => {
-            const headerValue = req.headers["x-elevenlabs-speech-engine-authorization"];
-            const token = Array.isArray(headerValue) ? headerValue[0] : headerValue;
-            if (!token) {
-                log("rejected connection — missing X-Elevenlabs-Speech-Engine-Authorization header");
-                socket.destroy();
-                return;
-            }
-            try {
-                (0, SpeechEngineResource_1.verifySpeechEngineJwt)(token, apiKey);
+            if (verifyToken) {
+                const headerValue = req.headers["x-elevenlabs-speech-engine-authorization"];
+                const token = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+                if (!token) {
+                    log("rejected connection — missing X-Elevenlabs-Speech-Engine-Authorization header");
+                    socket.destroy();
+                    return;
+                }
+                try {
+                    verifyToken(token);
+                }
+                catch (err) {
+                    log(`rejected connection — ${err instanceof Error ? err.message : String(err)}`);
+                    socket.destroy();
+                    return;
+                }
+                log("verified connection, upgrading to WebSocket");
             }
-            catch (err) {
-                log(`rejected connection — ${err instanceof Error ? err.message : String(err)}`);
-                socket.destroy();
-                return;
+            else {
+                log("auth disabled, upgrading connection without verification");
             }
-            log("verified connection, upgrading to WebSocket");
             wss.handleUpgrade(req, socket, head, (ws) => {
                 wss.emit("connection", ws);
             });
@@ -76,7 +90,7 @@ class SpeechEngineServer {
         wss.on("connection", (ws) => {
             this.handleConnection(ws);
         });
-        httpServer.listen((_c = this.options.port) !== null && _c !== void 0 ? _c : 3001);
+        httpServer.listen((_d = this.options.port) !== null && _d !== void 0 ? _d : 3001);
         this.wss = wss;
         this.httpServer = httpServer;
     }

package/dist/wrapper/speech-engine/types.d.ts

@@ -45,6 +45,17 @@ export type SpeechEngineEventName = keyof SpeechEngineEventMap;
 export interface SpeechEngineCallbacks {
     /** Enable debug logging. */
     debug?: boolean;
+    /**
+     * Disable verification of the `X-Elevenlabs-Speech-Engine-Authorization`
+     * JWT on incoming connections. When `true`, any client that can reach the
+     * server will be accepted.
+     *
+     * **Insecure.** Only enable this if you are protecting the server through
+     * another layer — typically an IP allowlist restricting traffic to
+     * ElevenLabs' egress ranges. Without that, anyone on the internet can
+     * open a session and consume your compute and downstream LLM quota.
+     */
+    disableAuth?: boolean;
     /** Fired once when the session is initialized with a conversation ID. */
     onInit?(conversationId: string, session: SpeechEngineSession): void;
     /** Fired each time the Speech Engine API sends a user transcript. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@elevenlabs/elevenlabs-js",
-    "version": "2.55.0",
+    "version": "2.56.0",
     "private": false,
     "repository": {
         "type": "git",

package/wrapper/speech-engine/SpeechEngineResource.js

@@ -111,9 +111,14 @@ class SpeechEngineResource {
      * ```
      */
     attach(httpServer, path, handler) {
-        var _a;
+        var _a, _b;
         const debug = (_a = handler.debug) !== null && _a !== void 0 ? _a : false;
+        const disableAuth = (_b = handler.disableAuth) !== null && _b !== void 0 ? _b : false;
         const log = debug ? (...args) => console.log("[SpeechEngine]", ...args) : () => { };
+        if (disableAuth) {
+            console.warn("[SpeechEngine] authentication is disabled on attach() — incoming connections will NOT be verified. " +
+                "Make sure the server is protected by either IP allowlist restricting traffic to ElevenLabs or using custom header values.");
+        }
         const wss = new ws_1.default.Server({ noServer: true });
         const upgradeListener = (req, socket, head) => __awaiter(this, void 0, void 0, function* () {
             var _a;
@@ -123,14 +128,19 @@ class SpeechEngineResource {
                 log(`path mismatch: expected ${path}, got ${url.pathname} — skipping`);
                 return;
             }
-            if (!(yield this.verifyRequest(req))) {
+            if (disableAuth) {
+                log("auth disabled, upgrading connection without verification");
+            }
+            else if (!(yield this.verifyRequest(req))) {
                 // verifyRequest returned false — get the detailed reason for debug logging
                 const reason = yield this.getVerificationFailure(req);
                 log(`rejected connection — ${reason}`);
                 socket.destroy();
                 return;
             }
-            log("upgrading connection to WebSocket");
+            else {
+                log("upgrading connection to WebSocket");
+            }
             wss.handleUpgrade(req, socket, head, (ws) => {
                 log("WebSocket connection established");
                 wss.emit("connection", ws);

package/wrapper/speech-engine/SpeechEngineServer.js

@@ -39,36 +39,50 @@ class SpeechEngineServer {
      * Start the standalone WebSocket server on the configured port.
      */
     start() {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         if (this.wss) {
             throw new Error("Server is already started");
         }
-        const apiKey = (_a = this.options.apiKey) !== null && _a !== void 0 ? _a : process.env.ELEVENLABS_API_KEY;
-        if (!apiKey) {
+        const disableAuth = (_a = this.options.disableAuth) !== null && _a !== void 0 ? _a : false;
+        const apiKey = (_b = this.options.apiKey) !== null && _b !== void 0 ? _b : process.env.ELEVENLABS_API_KEY;
+        if (!apiKey && !disableAuth) {
             throw new Error("SpeechEngine.Server requires an API key to verify incoming connections. " +
-                "Pass { apiKey: \"...\" } or set the ELEVENLABS_API_KEY environment variable.");
+                "Pass { apiKey: \"...\" } or set the ELEVENLABS_API_KEY environment variable. " +
+                "To run without authentication, pass { disableAuth: true } — but only behind an IP allowlist.");
         }
-        const debug = (_b = this.options.debug) !== null && _b !== void 0 ? _b : false;
+        const debug = (_c = this.options.debug) !== null && _c !== void 0 ? _c : false;
         const log = debug ? (...args) => console.log("[SpeechEngine]", ...args) : () => { };
+        if (disableAuth) {
+            console.warn("[SpeechEngine] authentication is disabled — incoming connections will NOT be verified. " +
+                "Make sure the server is protected by an IP allowlist restricting traffic to ElevenLabs.");
+        }
         const httpServer = (0, node_http_1.createServer)();
         const wss = new ws_1.default.Server({ noServer: true });
+        const verifyToken = disableAuth
+            ? null
+            : (token) => (0, SpeechEngineResource_1.verifySpeechEngineJwt)(token, apiKey);
         httpServer.on("upgrade", (req, socket, head) => {
-            const headerValue = req.headers["x-elevenlabs-speech-engine-authorization"];
-            const token = Array.isArray(headerValue) ? headerValue[0] : headerValue;
-            if (!token) {
-                log("rejected connection — missing X-Elevenlabs-Speech-Engine-Authorization header");
-                socket.destroy();
-                return;
-            }
-            try {
-                (0, SpeechEngineResource_1.verifySpeechEngineJwt)(token, apiKey);
+            if (verifyToken) {
+                const headerValue = req.headers["x-elevenlabs-speech-engine-authorization"];
+                const token = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+                if (!token) {
+                    log("rejected connection — missing X-Elevenlabs-Speech-Engine-Authorization header");
+                    socket.destroy();
+                    return;
+                }
+                try {
+                    verifyToken(token);
+                }
+                catch (err) {
+                    log(`rejected connection — ${err instanceof Error ? err.message : String(err)}`);
+                    socket.destroy();
+                    return;
+                }
+                log("verified connection, upgrading to WebSocket");
             }
-            catch (err) {
-                log(`rejected connection — ${err instanceof Error ? err.message : String(err)}`);
-                socket.destroy();
-                return;
+            else {
+                log("auth disabled, upgrading connection without verification");
             }
-            log("verified connection, upgrading to WebSocket");
             wss.handleUpgrade(req, socket, head, (ws) => {
                 wss.emit("connection", ws);
             });
@@ -76,7 +90,7 @@ class SpeechEngineServer {
         wss.on("connection", (ws) => {
             this.handleConnection(ws);
         });
-        httpServer.listen((_c = this.options.port) !== null && _c !== void 0 ? _c : 3001);
+        httpServer.listen((_d = this.options.port) !== null && _d !== void 0 ? _d : 3001);
         this.wss = wss;
         this.httpServer = httpServer;
     }

package/wrapper/speech-engine/types.d.ts

@@ -45,6 +45,17 @@ export type SpeechEngineEventName = keyof SpeechEngineEventMap;
 export interface SpeechEngineCallbacks {
     /** Enable debug logging. */
     debug?: boolean;
+    /**
+     * Disable verification of the `X-Elevenlabs-Speech-Engine-Authorization`
+     * JWT on incoming connections. When `true`, any client that can reach the
+     * server will be accepted.
+     *
+     * **Insecure.** Only enable this if you are protecting the server through
+     * another layer — typically an IP allowlist restricting traffic to
+     * ElevenLabs' egress ranges. Without that, anyone on the internet can
+     * open a session and consume your compute and downstream LLM quota.
+     */
+    disableAuth?: boolean;
     /** Fired once when the session is initialized with a conversation ID. */
     onInit?(conversationId: string, session: SpeechEngineSession): void;
     /** Fired each time the Speech Engine API sends a user transcript. */