Server-side keys
API keys are hashed at rest and designed for server-side use. Scope and revoke credentials per project.
// 01 / SECURITYTrust is part of
Trust is part of
the protocol.
Concrete controls around identity, credentials, provider dispatch, and the events your application receives.
// 03 / BOUNDARIESA request crosses
A request crosses
deliberate gates.
Authenticate
Bearer key is resolved to an active project.
Authorize
Scope, rate, quota, and project state are evaluated.
Reserve
Recipient capacity is reserved before provider I/O.
Dispatch
The delivery transport accepts the provider request.