Authentication

Every request to /v1/* carries an API key as a bearer token. There is no other authentication scheme, and there are no unauthenticated inference endpoints.

curl https://api.tiny-router.dev/v1/models \
  -H "Authorization: Bearer $TR_API_KEY"

Key shape

Keys look like tr-v1-…. Only a hash is stored, so a lost key cannot be recovered, only replaced.

Scoping a key

• A spend limit with a daily, weekly or monthly reset, or a lifetime cap.
• An allow-list of model ids, so a key for one service cannot spend on another.
• Rate and concurrency limits.
• Optional prompt and response capture, off by default. See limits and keys.

Checking a key

GET /v1/key returns the key's limits and usage without spending anything, which makes it a safe health check.