TypeScript

Point the base URL, mint a key per end user, call with that key. Attribution comes from the key — a shared key with an end-user header would be forgeable from the tenant's own code, and would make the spend cap advisory rather than enforced.

Set the gateway base to https://gw.ourseams.com/v1
Mint with POST /v1/keys at signup (step 2 — not optional)
Call with that ak_, model acme/smart

Complete example

const apiBase = "https://api.ourseams.com"
const gatewayBase = "https://gw.ourseams.com"
const secret = process.env.SEAMS_SECRET_KEY!

// step 2 — mint one ak_ per end user at signup; store it on their row
const minted = await fetch(`${apiBase}/v1/keys`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${secret}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ endUserId: "user_123", bundle: "default" }),
})
if (!minted.ok) throw new Error(await minted.text())
const { key } = (await minted.json()) as { key: string }

// step 3 — call with THAT key, never a shared one
const res = await fetch(`${gatewayBase}/v1/chat/completions`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${key}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    model: "acme/smart",
    messages: [{ role: "user", content: "hello" }],
  }),
})
if (!res.ok) throw new Error(await res.text())
console.log(await res.json())

POST /v1/keys answers 501 not_implemented until #70 lands. The shape above is the contract — run it when that issue closes.

POST /v1/chat/completions answers 501 not_implemented until #60 lands. The shape above is the contract — run it when that issue closes.