Astralane / Developers

Authentication and API keys

Dashboard sessions and inference API keys have different responsibilities.

Inference authentication

Send Authorization: Bearer <key> to inference endpoints. The Messages endpoint also accepts x-api-key. Keys are HMAC-SHA256 hashed with a server-side pepper; plaintext is only returned at creation.

Scopes and restrictions

inference permits generation; usage:read permits workspace usage reads; account:read permits wallet balance reads. Scope does not make usage key-specific: usage:read covers the workspace. Model allowlists, IP/CIDRs, expiry, request rates, concurrent request limits, and daily/monthly spend limits are enforced.

Dashboard sessions

Email/password authentication uses Better Auth. Production requires email verification and configured transactional email. GitHub and Google sign-in appear only when server-side credentials are supplied. Workspace roles and platform-admin user IDs are checked by the gateway.

Key handling

Never put keys in client-side bundles or commit them. The playground is an explicit local developer tool: its pasted key remains in component memory only. Rotate or revoke a suspected exposed key.

Handoff release

Native core and mock HTTP checks have run. Full dependency install, PostgreSQL/Redis integration, production builds, and browser flows still require local verification. See the repository verification report before deployment.