Authentication - QuotaMint

Project API keys

Send a project key as a bearer token:

curl "$RUNTIME/v1/check" \
  -H "Authorization: Bearer $QUOTAMINT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customerId":"user_123","feature":"generate_image","quantity":1}'

Project keys are environment-bound. qm_test_ selects development or staging; qm_live_ selects production. The runtime resolves the project and environment from the key alone before the request is processed.

Authentication failures

All of these are 401:

Missing or malformed bearer header
Unknown key
Revoked key
Key prefix/environment mismatch

The response uses the standard error envelope described in errors. Raw secrets are never logged.

Key lifecycle

Create and revoke keys from the dashboard. A newly created secret is returned once. Store it immediately, create a replacement for rotation, then revoke the old key after deployment.