API
API keys.
Keys gate source entitlements, scopes, and Telegram access. Full keys are shown once and stored hashed in D1.
Key lifecycle
CreateUse the account console to create a live, demo, or test key with source entitlements.StoreD1 stores key_prefix and salted key_hash. The full value is not recoverable after creation.UseSend X-API-Key on every production request.RotateRotation replaces the hash and prefix while preserving the key record and account ownership.RevokeRevoked keys should lose API and Telegram command access.Header auth
Use X-API-Key for agents, servers, and Telegram-linked workflows.
Demo URLs
api_key=xxx111 remains available for browser demonstrations.
Entitlements
Keys carry provider access such as TW, Elite, Nationwide, and R&S.
One key per workflow
Use separate keys for local agents, demos, and Telegram to make revocation clean.