API guides
Authentication
Workspace identity, scopes and key lifecycle
Router credentials represent a workload inside a workspace. They are service identities, not end-user sessions and not provider keys.
Bearer authentication
Send the service key on every HTTPS request.
Authorization: Bearer $OCTORYN_API_KEYUse the least-privileged scope
Inference, catalogue reads, governance summaries, route simulation and operations management are separate authorities. POST /v1/route/simulate and GET /v1/governance/summary require dedicated scopes.
Key lifecycle
Create separate keys per environment and workload, record an owner and expiry, rotate without changing upstream provider credentials, then revoke the superseded identity.
Keep secrets server-side
Do not embed production Router keys in browser JavaScript, iOS or Android binaries. UI SDKs should call a trusted backend or a deliberately scoped credential exchange.