Boundary
Workspace first
One workspace is one billed customer. Users, usage, keys, and invoices roll up there.
Production rollout
Authentication, workspaces, billing.
The endpoint surface above is the current contract. This is the commercial layer to place in front of it before broad release.
Human auth
Sessions for people
Dashboard users sign in with normal browser sessions. Machine traffic should not reuse them.
Machine auth
Scoped bearer keys
Issue multiple workspace keys with labels, scopes, expiries, and optional IP allowlists.
Plans
Subscription plus meter
Attach a base plan and a usage meter to the workspace, then gate features by entitlement.
Fixture samples intentionally omit auth headers until the machine-auth contract is finalized.
Read the full access modelReserved