Verify a key

The id of the api where the key belongs to. This is optional for now but will be required soon. The key will be verified against the api's configuration. If the key does not belong to the api, the verification will fail.

The key to verify

Perform RBAC checks

Use 'ratelimits' with [{ name: "default", cost: 2}]

You can check against multiple ratelimits when verifying a key. Let's say you are building an app that uses AI under the hood and you want to limit your customers to 500 requests per hour, but also ensure they use up less than 20k tokens per day.

The id of the key

Whether the key is valid or not. A key could be invalid for a number of reasons, for example if it has expired, has no more verifications left or if it has been deleted.

The name of the key, give keys a name to easily identifiy their purpose

The id of the tenant associated with this key. Use whatever reference you have in your system to identify the tenant. When verifying the key, we will send this field back to you, so you know who is accessing your API.

Any additional metadata you want to store with the key

The unix timestamp in milliseconds when the key will expire. If this field is null or undefined, the key is not expiring.

The ratelimit configuration for this key. If this field is null or undefined, the key has no ratelimit.

The number of requests that can be made with this key before it becomes invalid. If this field is null or undefined, the key has no request limit.

A machine readable code why the key is not valid. Possible values are:

• VALID: the key is valid and you should proceed
• NOT_FOUND: the key does not exist or has expired
• FORBIDDEN: the key is not allowed to access the api
• USAGE_EXCEEDED: the key has exceeded its request limit
• RATE_LIMITED: the key has been ratelimited
• UNAUTHORIZED: the key is not authorized
• DISABLED: the key is disabled
• INSUFFICIENT_PERMISSIONS: you do not have the required permissions to perform this action
• EXPIRED: The key was only valid for a certain time and has expired.

These are validation codes, the HTTP status will be 200.

Sets the key to be enabled or disabled. Disabled keys will not verify.

A list of all the permissions this key is connected to.

The environment of the key, this is what what you set when you crated the key

The associated identity of this key.