Authentication

All BudgetVec API endpoints (except /health) require authentication via a Bearer token.

API Keys

Each tenant is assigned one or more API keys during provisioning. Keys follow the format:

bv_live_<random_string>

Using Your Key

Include the key in the Authorization header:

curl https://budgetvec.standupcode.workers.dev/v2/namespaces \
  -H "Authorization: Bearer bv_live_your_api_key"

Or with the TypeScript SDK:

const client = new BudgetVecClient({
  baseUrl: "https://budgetvec.standupcode.workers.dev",
  apiKey: "bv_live_your_api_key",
});

Key Security

• Keys are stored as FNV-1a hashes in KV — raw keys are never persisted
• Always use HTTPS (enforced by Cloudflare)
• Rotate keys if compromised by contacting support or using the admin API
• Never commit keys to source control — use environment variables

Content Encoding

Request and response bodies use JSON (Content-Type: application/json), except for the JSONL import endpoint which uses text/plain.

All responses include CORS headers (Access-Control-Allow-Origin: *).