Public API

Customers can issue their own API keys from Settings → Developer.

Authenticating requests

Send the key as a header on any request:

x-api-key: sk_...

Any existing server route that calls requireSession()/requireAdmin() (server/utils/session.ts) already accepts this header the same way it accepts a cookie session — no separate API-key verification code is needed.

Rate limits

• A short-window rate limit (100 requests/minute) applies to every key, enforced by the apiKey plugin itself.
• A monthly usage cap applies per plan (server/utils/plans.ts) — exceeding it returns 429 until the calendar month rolls over.

Deployment

This template ships the API-key infrastructure only — no example protected resource is wired up on purpose. Add requireSession(event) to whatever resource route you build, the same way server/api/todos/*.ts already does.