elevenlabs.providers.sgit.ai / Pattern three, for a voice API — the sg.tts specification

Pattern three, for a voice API — the sg.tts specification

This is the site's argument made concrete: a browser application using a paid speech API without ever holding the key. Everything on this page is a specification. sg.tts does not exist; nothing here describes software you can run today.

Prose from the video vault at commit 7d1916aca5f3, 7 September 2026. From elevenlabs/docs/10-pattern-three-sg-tts.md, which is a specification and is treated as one. When the vault moves ahead, this page is behind — and says so rather than guessing.

What would exist already, if the verb landed tomorrow

Two of the three pieces are in place, which is the only reason this specification is worth publishing rather than filing.

The verb, as specified

// app side — would require "permissions": { "tts": { "speak": true } } in app.json;
// denied by default, as every host capability is.
const r = await sg.tts.speak({ text, voice?, model?, speed?, timestamps?: true });
// → { audio: Blob, durationSecs, alignment?: { characters, character_start_times_seconds,
//     character_end_times_seconds }, cost: { chars, usd, estimated: true } }

await sg.tts.available();   // { ok, reason?: 'ENOKEY' | 'EPERM' | 'EBUDGET' | 'EREADONLY' }
await sg.tts.voices();      // filtered by the policy's voice allow-list
await sg.tts.usage();       // this session's characters and estimated cost

What the host would do, in order:

1. Open the terms file. Owner-sealed, so only a session holding the vault's write key can open it; a read-only opener would get ENOKEY, exactly as the model-router verb does today.
2. Enforce the limits. Refuse over maxCharsPerRequest; keep a per-session character counter and refuse past maxCostPerSession at the model's list rate; hold a semaphore at maxConcurrent — which is also the mitigation for the concurrency question that is still open written, not run.
3. Ask, the first time. The first speak() in a session would raise the host's own prompt — "this app wants to generate speech with the vault's key — estimated $0.02" — outside the frame, where the app cannot suppress or fake it.
4. Make the call at the host's origin with the xi-api-key header, and strip the key from every error surfaced back to the frame.
5. Return audio and alignment, and nothing else. The frame gets a Blob and an array of numbers.

Why this is the only pattern where the bound holds

const { items } = JSON.parse(
  localStorage.getItem('el.keys.v1'));
fetch('https://api.elevenlabs.io/v1/…', {
  headers: { 'xi-api-key': items[0].key }
});

const { audio, alignment, cost } =
  await sg.tts.speak({ text, timestamps: true });
// no key, anywhere in this frame

The difference is not cosmetic. In the left-hand version, a cross-site scripting bug in the page is an account compromise. In the right-hand version, it is a request the host will meter and cap — the attacker gets speech, up to maxCostPerSession, and never gets the key.

What it would change for this estate

• The bench and every lab here would drop the key box, and the pattern box at the top of each would change from 0 with a ceiling to 3.
• app.json would no longer need "permissions": {"network": true} for these pages — which is the grant that bit us on day one verified 5 Sep 2026 and which is a real widening for any vault whose app holds private content.
• ElevenLabs would move, in the comparison, from needs a server to pattern 3, no server — because for a vault app the host is the server that pattern 2 keeps asking for. That is the generalisation the family of sites exists to test.

What would have to ship, precisely

So that this page is a specification with a scope rather than an aspiration. Three things, none of them in this repository:

What is already real: the terms file at .vault/elevenlabs/config.json, in the same shape and under the same seal as the model router's; and the permission floor that denies .vault/** to every app frame under every grant. Two of three pieces, and the missing one is the verb.

Until all three ship, no page on this site may say pattern three works here — and the build enforces it: the gate rejects sg.tts written in the present tense anywhere in the built site. That check exists because this is exactly the kind of page where a specification quietly becomes a claim.

What would still be true

The host is not magic. Under pattern 3 the terms are only as good as the numbers in them, the estimate is an estimate at list price rather than an invoice, and a compromised host is a compromised key — the trust moves, it does not vanish. What changes is who chose the blast radius and where the choice is recorded: a number in a file that travels with the content, rather than a promise about how carefully an application will behave.

Every claim on this site, with its state → Disclosures →