Authentication

Overview

External callers authenticate with an API key at the edge.
You should not call the core-api Worker as a public origin. Production traffic goes through edge-gateway, which:

1. Validates the caller credential (API key or equivalent)
2. Applies rate limits and quota checks where configured
3. Adds internal trust headers (X-Internal-Sig, X-Tenant-Id)
4. Forwards the request to core-api over a service binding

Obtaining an API key

1. Sign in to your dashboard
2. Navigate to API Keys
3. Click Create API key, set a name and expiry
4. Copy the key — it is shown only once

Using the API key

Add the key to every request in the Authorization (or X-API-Key) header:

curl https://api.example.com/v1/projects \
  -H "Authorization: Bearer $YOUR_API_KEY" \
  -H "Content-Type: application/json"

Caution

Never expose your API key in client-side code, public repositories, or logs. Treat it like a password.

Error responses

Status	Code	Meaning
401	UNAUTHORIZED	Missing or invalid API key
403	FORBIDDEN / UNTRUSTED_REQUEST	Missing permission or invalid trust signature
429	RATE_LIMITED	Too many requests — check your plan quota

{
  "error": "UNAUTHORIZED",
  "message": "Invalid or missing API key"
}

Key scopes

Scope	Permissions
read-only	GET requests only
read-write	GET, POST, PATCH, DELETE
admin	All operations including schema management

Rotating keys

Delete the old key from the dashboard and create a new one. Keys are invalidated immediately on deletion.