Spaces:
Running
Running
| <html lang="en"><head><meta charset="utf-8"> | |
| <meta name="viewport" content="width=device-width,initial-scale=1"> | |
| <title>a11oy · API Keys — issuance, scopes, rotation</title> | |
| <!-- SPDX-License-Identifier: Apache-2.0 · © 2026 SZL Holdings · Doctrine v12 additive · Signed: Yachay · Co-author: Perplexity Computer Agent --> | |
| <style> | |
| :root{--bg:#0a0b10;--panel:#12141d;--panel2:#171a25;--ink:#e8eaf0;--mut:#9aa0b4;--gold:#d9b35c;--line:#252938;--grn:#3fb950;--amb:#d29922;--red:#f85149;} | |
| *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);font:15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif} | |
| a{color:var(--gold);text-decoration:none}a:hover{text-decoration:underline} | |
| header{border-bottom:1px solid var(--line);padding:14px 22px;display:flex;align-items:center;gap:14px;background:linear-gradient(180deg,#10121b,#0a0b10)} | |
| header .brand{font-weight:700;letter-spacing:.5px;color:var(--gold);font-size:18px} | |
| header .tag{color:var(--mut);font-size:12px} | |
| nav{display:flex;flex-wrap:wrap;gap:8px;padding:10px 22px;border-bottom:1px solid var(--line);background:var(--panel)} | |
| nav a{font-size:12.5px;padding:4px 10px;border:1px solid var(--line);border-radius:999px;color:var(--mut)} | |
| nav a:hover{border-color:var(--gold);color:var(--gold);text-decoration:none} | |
| nav a.active{background:var(--gold);color:#0a0b10;border-color:var(--gold);font-weight:600} | |
| main{max-width:1040px;margin:0 auto;padding:28px 22px 60px} | |
| h1{font-size:26px;margin:0 0 4px;color:#fff}h2{font-size:18px;margin:28px 0 10px;color:var(--gold)} | |
| .sub{color:var(--mut);margin:0 0 18px;font-size:13.5px} | |
| .card{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:18px 20px;margin:14px 0} | |
| .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(230px,1fr));gap:14px;margin:16px 0} | |
| .grid a.tile{display:block;background:var(--panel2);border:1px solid var(--line);border-radius:12px;padding:16px;color:var(--ink)} | |
| .grid a.tile:hover{border-color:var(--gold);text-decoration:none} | |
| .grid a.tile .t{color:var(--gold);font-weight:600;margin-bottom:4px}.grid a.tile .d{color:var(--mut);font-size:12.5px} | |
| table{width:100%;border-collapse:collapse;margin:12px 0;font-size:13.5px} | |
| th,td{text-align:left;padding:8px 10px;border-bottom:1px solid var(--line);vertical-align:top} | |
| th{color:var(--mut);font-weight:600;font-size:12px;text-transform:uppercase;letter-spacing:.4px} | |
| code,pre{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12.5px} | |
| pre{background:#0d0f17;border:1px solid var(--line);border-radius:10px;padding:14px;overflow:auto;color:#cdd3e3} | |
| .pill{display:inline-block;padding:2px 9px;border-radius:999px;font-size:11.5px;font-weight:600} | |
| .g{background:rgba(63,185,80,.15);color:var(--grn)}.a{background:rgba(210,153,34,.15);color:var(--amb)}.r{background:rgba(248,81,73,.15);color:var(--red)}.n{background:#1c2030;color:var(--mut)} | |
| .note{border-left:3px solid var(--gold);padding:8px 14px;background:rgba(217,179,92,.06);color:#d8dbe6;font-size:13.5px;margin:14px 0;border-radius:0 8px 8px 0} | |
| footer{border-top:1px solid var(--line);color:var(--mut);font-size:11.5px;padding:18px 22px;line-height:1.7} | |
| .kbd{background:#1c2030;border:1px solid var(--line);border-radius:6px;padding:1px 7px;font-family:ui-monospace,monospace;font-size:12px} | |
| </style></head><body> | |
| <header><span class="brand">a11oy</span><span class="tag">Brand Orchestration Layer · the one place to see everything</span></header> | |
| <nav><a href="/hub">Hub</a><a href="/a11oy.code">a11oy.code</a><a href="/docs">Docs</a><a href="/pricing">Pricing</a><a href="/api-keys" class="active">API Keys</a><a href="/sdk">SDK</a><a href="/status">Status</a><a href="/observability">Observability</a><a href="/security">Security</a><a href="/compliance">Compliance</a><a href="/cued-engagement">Cued Engagement</a><a href="/uds">UDS</a><a href="/counter-uas">Counter-UAS</a><a href="/evidence">Evidence</a><a href="/upgrades">Upgrades</a><a href="/audit">Audit</a><a href="/gap-report">Gap Report</a></nav> | |
| <main><h1>API Keys — issuance, scopes, rotation</h1><p class="sub">Keys are tamper-evident (cosign signature over the key fingerprint), least-privilege by scope AND flagship, and instantly revocable. The server never stores the raw key — only sha256(key).</p> | |
| <h2>Key format</h2><pre>szl_{env}_{flagship?}_{base62(16 bytes)} | |
| env: live | test | |
| flagship (optional bind): a11oy | amaru | sentra | killinchu | rosie | |
| szl_live_d8Kf9... multi-flagship live key (allowlist in DB) | |
| szl_live_killinchu_Q2m7... live key hard-bound to killinchu only | |
| szl_test_4Hh1... sandbox key (no billing, no real fleet data)</pre><h2>Scopes</h2><table><tr><th>Action scope</th><th>Flagship allowlist</th><th>Enforcement</th></tr><tr><td>read / write / admin</td><td>a11oy · amaru · sentra · killinchu · rosie</td><td>server-side, derived from the OpenAPI path operationId verb class</td></tr></table><div class="note">Revocation writes a Khipu receipt and flips status to <code>revoked</code>; the next verification fails closed. A cosign signature lets a Greene-grade auditor verify the key-issuance event independently. Signing is honestly labeled <b>cosign PLACEHOLDER</b> (no Sigstore transparency-log inclusion yet).</div><p>Mint / revoke / rotate keys in the customer portal. This tab explains the model.</p> | |
| </main> | |
| <footer>Doctrine v12 (PURIQ) additive · v11/v12 LOCKED: 749 declarations · 14 axioms · 163 sorries · 13-axis yuyay_v3 · lutar-v18.0.0 @ c7c0ba17 · SLSA L1 (honest) · Khipu signature = DSSE/cosign PLACEHOLDER<br>HfApi direct push only · IP-HOLD a11oy#57 untouched · ADDITIVE / zero-regression · Khipu receipt on every action · Signed <b>Yachay</b> · Co-author Perplexity Computer Agent</footer> | |
| </body></html> |