Authentication

API keys (Bearer)

Tenant inference and catalog routes take Authorization: Bearer <Darouter API key> (or a configured JWT when operators enable it).

export DAROUTER_API_KEY=dar_…
curl -sS https://api.cybertronic.dev/v1/models \
  -H "Authorization: Bearer $DAROUTER_API_KEY"

• Portal-created keys — sign in at /portal, then create/revoke under API Keys (POST /v1/keys). The secret is shown once.
• Opt-in public signup — POST /v1/signup only when Operator Platform settings has public_signup=true (off by default).
• Operator-issued registration — admin-token POST /v1/registration (not on the public customer host).

Same host: api.cybertronic.dev. Do not invent a second customer portal host.

Portal session

The customer portal uses a session cookie for browser UX (Overview, Models, Billing, Logs, Optimization). Portal session is not an API key substitute for SDK traffic — use Bearer keys for /v1/chat/completions and related routes.

Operator admin cookies stay off /v1 customer routes. Do not treat operator VM UI as the customer portal.

BYOK pointers

Ships Register write-only provider secrets via POST /v1/byok/credentials (portal: API Keys → BYOK). Lists return metadata only — secrets are never re-shown. Full guide: /docs/byok-wallet.

BYOK spend is billed by your upstream provider. Portal Usage may show estimates separately from DragonLair-rated usage.

Fail-closed auth

Missing/invalid credentials return 401. Wallet freezes and budget hard-stops return 402 with documented codes — not silent success. See /docs/errors.

OpenAPI operations

Contract: /v1/openapi.json. Auth shapes you will hit first:

• GET /v1/models — Bearer project API key smoke test
• POST /v1/chat/completions — same Bearer key on the wire
• POST /v1/signup — public signup when enabled (portal Create account)
• POST /v1/byok/credentials — register BYOK after portal session

Portal browser session cookies are not a substitute for SDK Bearer keys.