Authentication

Scribiz takes one credential per run. It is either a Scribiz credential (your account, counted in minutes) or a Gemini key of your own (direct to Google, billed by Google).

Pick a credential

With your own Gemini key, the CLI fetches links and cuts audio on your machine and calls Google directly. Scribiz's own Google key stays on its servers. With a Scribiz sign-in, the CLI still fetches links and cuts audio on your machine, and sends the audio to Scribiz, which sends it to Google.

Sign in on the web

Open /login. There is no password: you get an email link, and the page also offers Google when it is set up. A link works once and expires after 5 minutes. A signed-in browser session is only for the website. Code uses keys.

Sign in from the CLI

scribiz login

The CLI shows a code and a link, and opens the link in a terminal. You confirm the code at https://scribiz.com/login/device while you are signed in to Scribiz. The CLI then saves a Scribiz key to ~/.scribiz/config.json, readable by you only. This needs scribiz 0.1.1 or newer.

• The key counts in your plan's minutes. A free account has 30 minutes a month. scribiz whoami shows how many you have left.
• Your audio goes from your machine to Scribiz, which sends it to Google. With --visual, so does a low-resolution copy of the video.
• The key is listed in the dashboard under API keys, with CLI on and the name of your machine. Revoke it there.
• A code lasts 10 minutes. Without a terminal to open a browser, or on a server, make a key in the dashboard and set SCRIBIZ_API_KEY, or run scribiz login --key and paste it.
• When your minutes are used up, the CLI stops with exit code 3 and says when they come back. Your own Gemini key is the other way: run scribiz setup.

scribiz logout removes the saved key from this machine. It does not revoke it, because the CLI does not tell Scribiz. The key keeps working until you revoke it in the dashboard.

API keys

Keys are created and revoked in the dashboard under API keys.

• A key looks like sbz_live_ followed by random characters. Copy it when it is created. It is shown once.
• Scribiz stores only a hash of the key, so a lost key cannot be recovered. Create a new one and revoke the old one.
• Each key has a scope: all, mcp or read. all includes the others, and mcp includes read.
• You can have up to 10 keys. The dashboard shows when each was last used.
• A revoked key stops working within about a minute.
• A key cannot create or revoke keys. That needs a signed-in session, so it happens in the dashboard.

Send a key as a bearer token, or in an X-API-Key header:

curl https://scribiz.com/api/v1/me \  -H "Authorization: Bearer $SCRIBIZ_API_KEY"

curl https://scribiz.com/api/v1/me \  -H "X-API-Key: $SCRIBIZ_API_KEY"

API authentication covers scopes and rotation.

Use your own Gemini key

This is the way to run the CLI without an account. With a Gemini key the CLI processes on your machine and calls Google directly. Scribiz minutes are not used, and Google bills you. Speech to text costs about $0.32 per hour of audio at today's prices, plus a fraction of a cent for the summary, and Google's free tier may cover light use. Get a key at Google AI Studio.

export GEMINI_API_KEY=your_gemini_key_herescribiz ./interview.mp4

Or run scribiz setup and paste the key once. It checks that the key works before saving it to ~/.scribiz/config.json, readable by you only. Without a terminal, pipe the key in: echo "$KEY" | scribiz setup. A Scribiz key does not go here: setup refuses a key that starts with sbz_ before it contacts Google, and points you to scribiz login --key.

The key is sent to Google and nowhere else. It never goes to Scribiz servers.

Which credential wins

For the CLI, the first match in this list is used:

1. SCRIBIZ_API_KEY in the environment.
2. GEMINI_API_KEY in the environment.
3. The config file: a saved Scribiz key, then a Gemini key from scribiz setup.

The config file holds one credential at a time. scribiz login and scribiz setup replace each other: signing in removes a saved Gemini key, and saving a Gemini key removes a saved sign-in. Environment variables are not touched, so a GEMINI_API_KEY that is still set keeps a run on your own key after you sign in. Run scribiz whoami to see which one a run will use: it says when GEMINI_API_KEY is overriding a saved sign-in. --no-config ignores the config file. Config and env lists every variable.

scribiz logout removes what the file holds. It never revokes a Scribiz key, and it leaves your environment alone.

Sessions are not keys

The website uses a cookie session. The CLI never keeps a session: when you sign in from the command line, the approval is swapped for an API key, which you can see and revoke in the dashboard. Code uses an API key.