Authentication

Two ways to talk to the gateway: an API key for programmatic clients, or a session cookie for the dashboard. The proxy at /v1/* only accepts API keys.

API keys

Keys are stored as a hash + last-4 prefix in D1. The full secret is shown once at creation and never again. Pass it as a Bearer token:

Authorization: Bearer edgrt_…

Each key has its own knobs you can tune from the dashboard:

• Rate limit — requests per minute, enforced via Cloudflare KV.
• Retry count — gateway retries on 429 / 5xx (exponential backoff).
• Timeout — request deadline in ms. Aborts the upstream call.
• Model restrictions — optional allowlist of model strings.
• Budget — monthly $ ceiling; once hit, requests 429.

Dashboard sessions

The dashboard at edgerouteai.com/dashboard uses better-auth cookie sessions. The /api/* management routes accept either a session cookie or an API key, so you can script the dashboard endpoints from the CLI if you want.

Superadmin

The first user to sign up is granted the superadmin role. They get access to /dashboard/admin for managing platform-key pool entries and inspecting global usage.

Best practices

• One key per environment / per app. Never reuse a prod key in CI.
• Rotate keys on a schedule. Revocation is instant — old ones return 401 immediately.
• Set a budget on every key. The free 1K BYOK requests/month don't protect you from a runaway loop calling Opus.