Authentication
Buyer traffic uses Authorization: Bearer <buyer_key> on POST /v1/chat/completions. Seller traffic uses X-Seller-API-Key on every /v1/sellers/* route except POST /v1/sellers/register, which is public.
Authentication runs before rate limiting. A missing or invalid credential returns 401 with { "code": "unauthorized", "message": "..." }, not 429 rate_limited. See Errors and Rate limits.
| audience | header | used on |
|---|---|---|
| Buyer | Authorization: Bearer <buyer_key> | POST /v1/chat/completions |
| Seller | X-Seller-API-Key: <seller_key> | /v1/sellers/{id}/* after register |
| Public | none | POST /v1/sellers/register |