AIality Infrastructure pilot

Authentication

Every REST and MCP Gateway route except /healthz requires authentication. There is no anonymous integration path.

Bearer API keys

Authorization: Bearer gwk_<your key>

Keys have the form gwk_<random secret>. Only the key's SHA-256 hash is stored server-side; the raw secret is shown once at creation and cannot be retrieved again.

Issuance

Keys are created by an AIality operator today, not through a public self-service endpoint. Contact Contact email: pending domain / email setup or go through the pilot process.

Revocation

A key can be individually revoked, and a principal (the account a key belongs to) can be disabled independently. Both are checked on every request; a revoked key or disabled principal is rejected immediately.

MCP transports

Stdio transport authenticates once at process startup from an environment variable. HTTP transport requires the same Authorization: Bearer header on every request (it is stateless — see MCP).

Not yet available

  • OAuth / SSO
  • Self-service key issuance or rotation via API