Authentication

API keys

Send Authorization: Bearer <key> on API requests. Secrets start with eur_ and are returned only when created. Keep keys on your server, never in public browser code or source control.

Keys belong to one organization. Revocation, expiry, organization suspension and removal of the creator from the organization block subsequent requests. Key limits reserve against concurrent requests; usage is committed when authoritative evidence is available.

Console sessions

The console uses Better Auth with verified email, MFA, passkeys and revocable sessions. Admin and billing actions on HTTPS deployments require MFA enrollment and a session created after enrollment. Mutations require a login from the last 15 minutes.

Rotation

Create a replacement key, update your application and verify a request before revoking the old key. A revoked key cannot be restored. Do not send a provider credential as an EU Router API key.