Auth

Every request to /v1/* is authenticated by an API key in the Authorization: Bearer <key> header. Keys are prefixed gw_live_ and issued per team from /keys after sign-in.

Scopes

A key carries one or more scopes. The default chat scope is enough to call /v1/chat/completions, /v1/messages, and /v1/responses. /v1/models enumeration needs no scope beyond a valid key. The capability marketplace has its own scopes (marketplace:read, marketplace:publish, marketplace:approve), and publish implies read so you do not have to enumerate both. Scopes are additive and can be tightened later in /keys without revoking the key; a scope name the gateway does not recognise is rejected at issue time rather than stored.

Rate limits and budgets

Each key can carry a per-minute request cap (rpm_limit), a per-minute token cap (tpm_limit), and a daily USD budget (daily_budget_usd). The gateway returns a 429 once any cap is hit, with the canonical OpenAI or Anthropic error body shape so the SDK classifies the failure cleanly. See the FAQ for the X-RateLimit-Scope header that names which specific cap fired, and how to read the Retry-After window it carries.

Revocation

Revoking a key from /keys marks it inactive immediately. The gateway re-checks a key's status on every request, including cache lookups, so a revoked key starts returning 403 API key revoked on the very next request with no propagation lag -- there is no window where a revoked key can still be served, cached or not. A missing or unrecognised key gets 401 instead, so a client can tell "no credential" apart from "credential withdrawn".