Authentication

Every request to the Brume API is authenticated with a project API key, sent as a bearer token:

Authorization: Bearer brk_...

There is no JWT layer and no token exchange. One key, one header, one project.

Scopes

Every key carries explicit scopes. A key with no scopes has no access, and key creation rejects an empty scope list. The scopes are:

Practical guidance: your application's hot path should use a key with only rate_limit. Keep a separate manage_project key in your deploy tooling, and never ship a manage_keys key to a runtime.

Key hygiene

• Keys are hashed at rest. The plaintext value is returned exactly once, at creation.
• Rotation is create-then-revoke: mint the new key, deploy it, revoke the old one. There is no in-place re-roll.
• Revocation takes effect as the auth cache expires (seconds, not minutes).

Where keys are checked

The gateway verifies the key, resolves its project and tier, and loads its scopes before any handler runs. Scope enforcement happens inside the handlers: evaluation requires rate_limit, admin CRUD requires manage_project, analytics requires read_stats.

A failed lookup or a missing scope returns 401 with a JSON error body — see Error Handling.