Skip to main content
InferenceWall authenticates requests using API keys with two distinct roles: scan for scanning and analysis endpoints, and admin for management and configuration endpoints. You pass the key in the Authorization header of every request.

​
Dev mode

If the IW_API_KEY environment variable is not set, authentication is disabled entirely. This is convenient for local development, but you must enable auth before deploying to production.

​
Generating keys

Run the setup command to generate both a scan key and an admin key:
This writes the generated keys to .env.local in your working directory. Source the file to load them into your environment:
Keys use the following format:

​
Passing the key

Include your API key in the Authorization: Bearer header on every request:

​
Key roles

Each key type grants access to a specific set of endpoints:
Use the scan key in your application code. Reserve the admin key for management scripts and CI pipelines.

​
Auth endpoints

​
POST /v1/auth/login

Log in with your admin key. On success, InferenceWall sets an httpOnly session cookie that you can use for subsequent requests. Request body:
​
string
required
Your admin API key (iwk_admin_ prefix).

​
POST /v1/auth/logout

Clear the current session cookie.

​
GET /v1/auth/check

Check whether the current session cookie is valid.

​
Error responses

When a request is made without a valid key or session, the API returns 401 Unauthorized:

​
Security best practices

Never commit API keys to source control. Use environment variables or a secrets manager.
  • Enable TLS in production by setting IW_TLS=auto. This uses automatic certificate management via ACME.
  • Rotate keys regularly and revoke any that are no longer in use.
  • Scope your application’s key to the minimum required role — use iwk_scan_ keys in application code and reserve iwk_admin_ keys for management operations.