Skip to content

docs(ai-gateway): document the service-role-only gateway rule #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yardend-wix merged 3 commits into from
Oct 14, 2026
Merged

docs(ai-gateway): document the service-role-only gateway rule #330

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c89929e
docs(ai-gateway): document the service-role-only gateway rule
yardend-wix Oct 14, 2026
995170e
docs(ai-gateway): state the rule as server-side with the app's servic…
yardend-wix Oct 14, 2026
36d4aa6
docs(ai-gateway): trim Authentication Modes to two bullets
yardend-wix Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions packages/sdk/src/modules/ai-gateway.types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,9 @@ export interface AiGatewayConnection {
/** Base URL of the selected gateway provider. */
baseURL: string;
/**
* Bearer token that authenticates the request. Empty string when the caller is
* unauthenticated.
* Bearer token that authenticates the request: the service-role token from
* `base44.asServiceRole.aiGateway`, or the signed-in user's token from
* `base44.aiGateway`. The gateway expects the service-role token.
*/
token: string;
/**
Expand Down Expand Up @@ -94,8 +95,8 @@ export interface AiGatewayModuleConfig {
*
* The mode determines which token `connection()` returns:
*
* - **User authentication** (`base44.aiGateway`): Returns the signed-in app user's token.
* - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the service-role token instead. Use it from backend functions: apps that restrict Core integrations, the default for new apps, reject user-token gateway calls on public apps. It also works when there's no signed-in user, such as from a scheduled automation.
* - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the app's service-role token. Use it server-side; the gateway rejects other calls with a `403` and the error code `ai_gateway_requires_service_role`. It also works with no signed-in user, such as from a scheduled automation.
* - **User authentication** (`base44.aiGateway`): Returns the signed-in app user's token. The gateway accepts it only on apps shared privately or with your workspace.
*
* ## Billing and limits
*
Expand Down
Loading