Authentication

Runtime keys for Fly, org API keys for the dashboard, and gateway ingest secrets.

Runtime API keys (clients)

Mint itr_rt_* in Settings → Runtime API keys. Send Authorization: Bearer itr_rt_… to https://intertrace.fly.dev/v1. Keys are shown once — store them in a secret manager. Upstream provider secrets stay in the Provider vault.

Org API keys (control plane)

Mint an org API key in Settings → API keys. Send it as X-Intertrace-Key or Authorization: Bearer itr_… to dashboard routes used by itr: discover ingest, policy gitops, permission-check, usage import, and Agent Control.

Dashboard session

Console users sign in at platform.intertrace.ai (Clerk). Session cookies authorize dashboard APIs; mutating routes also enforce CSRF where applicable. Early access codes gate first-org signup — Early access.

Gateway → dashboard ingest

The data plane posts events with INTERTRACE_INTERNAL_SECRET (or legacy BASTION_INTERNAL_SECRET). Never expose that secret to browsers or third-party clients.