Kokoro-FastAPI

• Open the Kokoro-FastAPI offer on the Azure Marketplace, choose Get It Now, then choose Create.
• Select your subscription, resource group and region, and choose the Standard_D2s_v5 size.
• Provide your SSH public key for the azureuser account.
• In the network security group, allow inbound TCP 22 and TCP 80 from your trusted networks, then create the VM.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:kokoro-fastapi-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name kokoro-01 \
  --image sac1647283583153:kokoro-fastapi-ubuntu-24-04:default:latest \
  --size Standard_D2s_v5 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

On the first boot of every VM, kokoro-fastapi-firstboot.service generates a fresh, unique API key, writes it into the nginx authentication gate and reloads nginx, brings the TTS container up, and writes the key to /root/kokoro-fastapi-credentials.txt. First boot takes under a minute, so wait a moment before you send the first request.

SSH in as azureuser. Confirm that Docker, the TTS service and nginx are active and that the health check answers. The health endpoint is intentionally open and needs no key:

systemctl is-active docker kokoro-fastapi nginx curl -s http://127.0.0.1/health

You should see active for each service and {"status":"healthy"} from the health check.

The API key is unique to this VM and is stored in a root-only file:

sudo cat /root/kokoro-fastapi-credentials.txt

The KOKORO_API_KEY value is your Bearer token. Keep it secret. Store it in a shell variable for the next steps. From your own workstation, use the value you just read:

KEY=$(sudo grep '^KOKORO_API_KEY=' /root/kokoro-fastapi-credentials.txt | cut -d= -f2)

The speech endpoint rejects an unauthenticated request and accepts an authenticated one. Run both requests to confirm:

KEY=$(sudo grep '^KOKORO_API_KEY=' /root/kokoro-fastapi-credentials.txt | cut -d= -f2)
# No key -> 401 Unauthorized curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1/v1/audio/speech \
  -H 'Content-Type: application/json' \
  -d '{"model":"kokoro","input":"hello","voice":"af_bella","response_format":"wav"}'
# With the per-VM key -> 200 OK curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1/v1/audio/speech \
  -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \
  -d '{"model":"kokoro","input":"hello","voice":"af_bella","response_format":"wav"}'

The first call prints 401; the second prints 200.

Generate a WAV file from text with the OpenAI-compatible endpoint and your API key:

KEY=$(sudo grep '^KOKORO_API_KEY=' /root/kokoro-fastapi-credentials.txt | cut -d= -f2)
curl -s -X POST http://127.0.0.1/v1/audio/speech \
  -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \
  -d '{"model":"kokoro","input":"Hello world, this is Kokoro FastAPI running on Azure.","voice":"af_bella","response_format":"wav"}' \
  --output hello.wav file hello.wav

file hello.wav reports a RIFF WAVE audio file. Supported response_format values are wav, mp3, flac, opus, aac and pcm.

All 68 voices are baked into the image. List them through the authenticated endpoint:

KEY=$(sudo grep '^KOKORO_API_KEY=' /root/kokoro-fastapi-credentials.txt | cut -d= -f2)
curl -s http://127.0.0.1/v1/audio/voices -H "Authorization: Bearer $KEY" \
  | python3 -c "import sys,json; v=json.load(sys.stdin)['voices']; names=[x['id'] if isinstance(x,dict) else x for x in v]; print('voices:',len(names)); print(', '.join(names[:12]))"

The output shows the voice count and a sample of the available voices, for example af_bella, af_heart, af_nicole, am_michael and bf_emma. To combine voices, join their names with + in the voice field, for example af_bella+af_sky.

Because the API is OpenAI-compatible, you can point the official client at your VM and use your per-VM key. Replace <vm-ip> and <your-key> with your values:

from openai import OpenAI client = OpenAI(base_url="http://<vm-ip>/v1", api_key="<your-key>") with client.audio.speech.with_streaming_response.create( model="kokoro", voice="af_bella", input="Hello from the OpenAI client.", response_format="wav", ) as response: response.stream_to_file("out.wav")

To issue a new key, edit the nginx gate and reload nginx. The example below shows the approach, so generate your own strong random key:

NEWKEY=$(openssl rand -hex 32)
sudo sed -i "s#\"Bearer .*\" 1;#\"Bearer ${NEWKEY}\" 1;#" /etc/nginx/conf.d/sac-kokoro-key.conf
sudo nginx -t && sudo systemctl reload nginx
# record the new key somewhere safe; update /root/kokoro-fastapi-credentials.txt if you rely on it echo "$NEWKEY"

• Keep port 80 open only to the clients that need it, using a tightly scoped NSG rule. The endpoint is authenticated, but the model still consumes CPU on every request.
• Terminate TLS in front of the API so that the Bearer key is never sent in clear text. Add a certificate to nginx, or place the VM behind an Azure Application Gateway or Load Balancer with HTTPS.
• Treat the contents of /root/kokoro-fastapi-credentials.txt as a secret, and rotate the key (Step 10) if you suspect it was exposed.
• Keep the OS patched. The image ships fully updated with unattended security upgrades enabled.

Kokoro-FastAPI is free, open-source software distributed under the Apache License 2.0. This image bundles Kokoro-FastAPI unmodified. Its license governs your use of the server, and the Kokoro model and voices are governed by their respective licenses.

SecureAnyCloud images include 24/7 support. If you need help deploying or configuring Kokoro-FastAPI on Azure, contact us.

Deploy on Azure

Find this image on the Azure Marketplace and deploy in minutes.

Need Help?

Email sales@secureanycloud.com and our team will help you get up and running.

Deploy on Azure

Launch Kokoro-FastAPI 0.6.0 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com