Service
Keys, labels and callers
A service may hold several keys, each under a label. Permission, rate limit and endpoint narrowing attach to the key — the label is the address.
"Max may use the company account; the build service may not" is a sentence one-key-per-service cannot express, and a broker that cannot express it hands out the more privileged key by default. So permission is per key, not per service.
A service holds any number of keys, each under a label. The label is the address: /tavily/search reaches the key labelled default, /tavily:personal/search reaches the one labelled personal. Each label carries its own callers, its own rate limit, and — if you want it — a narrower list of endpoints than the service allows in general. A config that tries to widen what the catalogue allows is refused at startup, not discovered at 2am.
The same string is the first path segment, the policy key, the secrets key, the rate-limit bucket and the audit line's upstream field. One definition, so no resolution step can disagree with another, and no call can be served by one key and attributed to a different one.
Configured in one root-owned file on the host. Callers change nothing.
Am I in your service area?
Enter your postal code or city and we'll check the drive time from our shop.
